JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated… (CVE-2026-108678)

CVE-2026-108678 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the queryUserRoles handler of the SystemApiController. Authenticated users can exploit this flaw by sending crafted GET requests to the /sys/api/queryUserRoles endpoint with arbitrary usernames, enabling them to read any user's role codes. This allows low-privileged attackers to enumerate role assignments and identify administrator accounts, potentially aiding further attacks.

The vulnerability allows authenticated low-privileged users to enumerate role assignments of any user, including administrators, by reading role codes without proper authorization checks. This information disclosure could facilitate targeted attacks against high-privilege accounts but does not directly allow privilege escalation or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /sys/api/queryUserRoles endpoint to trusted users only and monitor for suspicious activity involving role enumeration attempts.