JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated… (CVE-2026-108627)

CVE-2026-108627 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5 within the loadDatarule handler of the SysRoleController component. Authenticated users can exploit this flaw by issuing a GET request to the endpoint /sys/role/datarule/{permissionId}/{roleId}, enabling them to retrieve sensitive role data rule information such as rule names, columns, conditions, values, and associated rule IDs. This vulnerability does not allow modification or denial of service but leaks potentially sensitive configuration data related to role permissions.

The vulnerability allows low-privileged authenticated users to read detailed role data rules, which could aid in further reconnaissance or privilege escalation attempts. However, it does not impact data integrity or availability. The confidentiality impact is limited to disclosure of role data rule information.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious access patterns.