JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any… (CVE-2026-108891)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the SysUserController's getUserDetailByUserId handler. This vulnerability permits any authenticated user to bypass authorization controls and retrieve sensitive personal information of other users by providing arbitrary userId parameters. The exposed data includes real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths, and posts. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). There is no indication of known exploits in the wild or vendor-provided patches at this time.

An attacker with low privileges who is authenticated can read sensitive personal information of other users, including identifying and contact details. This could lead to privacy violations and potential social engineering attacks. The vulnerability does not allow modification or denial of service, only information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected handler or implement additional authorization checks to prevent unauthorized user detail retrieval.