JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated… (CVE-2026-108652)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SystemApiController's updateAvatar handler. Authenticated users can exploit this by sending PUT requests specifying a target user ID and an arbitrary image URL, enabling them to replace avatars of other users, including administrators. This is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

The impact is limited to unauthorized modification of user avatars, which could be used to impersonate or misrepresent users visually. There is no direct impact on confidentiality or system availability. The integrity of user profile images can be compromised by low-privileged authenticated attackers.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the updateAvatar API to authorized users only and monitor for suspicious avatar changes if possible.