CVE-2026-7604 Details
Description
A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.
A second-order server-side request forgery (SSRF) vulnerability exists in JeecgBoot versions through 3.9.1. The issue is located in the OpenApi Service, specifically within the OpenApiController.java file, in the add and call methods. The vulnerability arises because the add method allows authenticated users to inject malicious URLs into the originUrl database field without proper validation or authorization. When the call method is later invoked, it retrieves the unvalidated URL and makes an outbound HTTP request, potentially bypassing network segmentation and accessing sensitive internal resources or cloud metadata.
Users are advised to upgrade to version 3.9.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 2, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jeecgboot/JeecgBoot/ | [email protected] | ProductVendor |
| https://github.com/jeecgboot/JeecgBoot/issues/9554 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jeecgboot/JeecgBoot/issues/9554#issuecomment-4251574151 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/805708 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360561 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360561/cti | [email protected] | Permission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JeecgBoot | <= 3.9.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 2, 2026 | New CVE Received | [email protected] |