CVE-2026-78970 Details

An authorization bypass vulnerability has been identified in JeecgBoot versions through 3.9.2, specifically within the SystemApiController component. This vulnerability allows authenticated attackers with valid JWT tokens to access several API endpoints, including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds. The lack of fine-grained permission checks and incomplete data desensitization enables the retrieval of sensitive information for all users, such as real names, phone numbers, email addresses, employee numbers, and role definitions.

To address this vulnerability, it is recommended to implement fine-grained role and permission checks on the affected API endpoints. Additionally, sensitive information should be properly desensitized before being returned in API responses. For more detailed guidance, refer to the JeecgBoot issue #9674.