JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any… (CVE-2026-108867)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the SystemApiController's getUserRoleSetById handler. Authenticated users can exploit this flaw by providing an arbitrary userId parameter to retrieve role codes assigned to other users, including administrator accounts, without possessing the required system:user:queryUserRole permission. This unauthorized information disclosure could aid attackers in reconnaissance but does not allow modification or denial of service. The CVSS 3.1 score is 4.3 (medium), reflecting low impact on confidentiality and no impact on integrity or availability.

The vulnerability allows unauthorized disclosure of user role assignments to any authenticated user. Attackers with low privileges can identify administrator accounts, potentially facilitating targeted attacks. There is no impact on data integrity or availability. No known exploits are reported in the wild.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious use of the getUserRoleSetById API. Implement additional access controls if possible to prevent unauthorized role enumeration.