JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged… (CVE-2026-108674)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the OpenApiController's queryById handler. Low-privileged authenticated users can bypass permission checks and access OpenAPI definitions, exposing internal configuration details including origin URLs, virtual paths, IP whitelists, and header and parameter templates. This information disclosure could aid attackers in further reconnaissance or targeted attacks. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and low privileges required, with no user interaction needed and limited confidentiality impact.

The vulnerability allows unauthorized disclosure of internal OpenAPI definitions and sensitive configuration data such as internal URLs, IP whitelists, and request templates. While it does not allow modification or denial of service, the information exposure could facilitate further attacks or reconnaissance by adversaries with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the OpenApiController queryById endpoint to trusted users only and monitor for suspicious access patterns. Avoid granting unnecessary permissions to low-privileged users.