JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the… (CVE-2026-108866)

CVE-2026-108866 is a missing authorization vulnerability in JeecgBoot up to version 3.9.5. Authenticated users can manipulate the queryUserAuths handler by providing arbitrary userId parameters, enabling them to access the permissions of other users without proper authorization checks. This flaw allows low-privileged attackers to enumerate permissions and identify administrator accounts, potentially aiding further privilege escalation or targeted attacks.

The vulnerability allows unauthorized disclosure of user permission data, which can lead to information leakage about account privileges, including administrator accounts. This exposure could facilitate targeted attacks or privilege escalation attempts by malicious actors. However, it does not directly allow modification or denial of service.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the queryUserAuths handler to trusted users only and monitor for suspicious activity involving userId parameter manipulation.