JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any… (CVE-2026-108653)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the queryPageList handler of the OpenApiController. This vulnerability permits any authenticated user to list OpenAPI registry definitions by querying the GET /openapi/list endpoint. Low-privileged attackers can exploit this to read sensitive configuration data including virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

An attacker with any authenticated access can enumerate sensitive OpenAPI configuration details that are normally restricted to administrators. This exposure could aid further reconnaissance or targeted attacks by revealing internal URLs, IP whitelists, and administrative templates. However, the vulnerability does not allow modification or denial of service, limiting its impact to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the OpenApiController endpoints to trusted users only and consider additional access controls or network segmentation to limit exposure.