JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged… (CVE-2026-108655)

The vulnerability in JeecgBoot up to version 3.9.5 involves a missing authorization check in the QuartzJobController's queryById endpoint. Authenticated users with low privileges can send a GET request to /sys/quartzJob/queryById with a job ID and retrieve sensitive scheduling information such as job class names, cron expressions, job parameters, and job status. This information disclosure is due to improper access control, classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and low privileges required, resulting in limited confidentiality impact without integrity or availability effects.

Low-privileged authenticated users can read sensitive scheduled job configuration details that are intended for administrators only. This information disclosure could aid attackers in understanding internal job scheduling and potentially facilitate further attacks, but does not directly impact system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the /sys/quartzJob/queryById endpoint to authorized administrator roles only, if possible, and monitor for unauthorized access attempts.