JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets… (CVE-2026-108649)

CVE-2026-108649 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5. The issue exists in the queryUserRolesById handler of the SystemApiController, where authenticated users can query role codes of any user by specifying a userId parameter. This allows low-privileged attackers to enumerate role assignments and potentially identify administrator accounts. The vulnerability is classified under CWE-862 (Missing Authorization).

The vulnerability allows authenticated low-privileged users to access role information of arbitrary users, which can lead to information disclosure about user roles and administrative accounts. There is no direct impact on integrity or availability reported. This information disclosure could aid attackers in planning further attacks by identifying high-privilege accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity involving role enumeration.