CVE-2026-9581 Details
Description
A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended.
A mass assignment vulnerability has been identified in JeecgBoot versions prior to 3.9.1. This vulnerability allows authenticated users to inject values into user identification fields, such as 'fromUserId', 'toUserId', and 'createBy', thereby impersonating other users. The issue arises from the absence of proper access controls on certain endpoints, which allows for unauthorized manipulation of user identity data. The vulnerability can be exploited remotely, and a public exploit is available.
Upgrading to JeecgBoot version 3.9.2 addresses this vulnerability by implementing proper access controls and ensuring that user identification fields are correctly managed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jeecgboot/JeecgBoot/issues/9598#issuecomment-4385719753 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jeecgboot/JeecgBoot/ | [email protected] | ProductVendor |
| https://github.com/jeecgboot/JeecgBoot/issues/9598 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jeecgboot/JeecgBoot/issues/9598#issuecomment-4385719753 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2 | [email protected] | Release NotesVendor |
| https://vuldb.com/submit/817918 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365637 | [email protected] | AdvisoryPermission RequiredRemedy |
| https://vuldb.com/vuln/365637/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JeecgBoot | <= 3.9.1 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |