JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated… (CVE-2026-108887)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysCommentController exportXls handler. This allows any authenticated user to invoke the exportXls function and retrieve all comment data, including sensitive information such as comment text and user IDs, regardless of their privilege level or access rights. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact is limited to confidentiality loss of comment data; integrity and availability are not affected.

An attacker with any authenticated access can export all comments from the system, including those they are not authorized to view. This results in unauthorized disclosure of potentially sensitive comment text and user identifiers. There is no impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the exportXls endpoint to only authorized users or disable the export functionality if possible.