JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any… (CVE-2026-108886)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysUserController's queryChildrenByUsername handler. Authenticated users can exploit this to supply arbitrary userId values and access sensitive account records of other users, including personal and organizational details. This is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. Confidentiality impact is low, with no integrity or availability impact.

An attacker with any authenticated access can obtain sensitive user information such as names, emails, phone numbers, employee numbers, and department-related data of other users. This exposure of personal and organizational data can lead to privacy violations and potential reconnaissance for further attacks. There is no direct impact on system integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected handler or implement additional authorization checks to prevent unauthorized data access.