Threats tagged 'ghsa-6w4x-5vf2-7756'

JeecgBoot versions through 3.9.2 have a broken access control vulnerability allowing authenticated low-privilege users to fully manage OpenAPI credentials via endpoints lacking proper authorization. This enables attackers to list, add, edit, and delete all API key pairs, with secret keys exposed in plaintext, risking credential theft and unauthorized API access.