CVE-2026-108867

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6

Description An authorization flaw exists in the getUserRoleSetById handler within the 'SystemApiController' endpoint. This issue allows authenticated users to retrieve role assignments of other users by providing an arbitrary userId parameter. Consequently, low-privileged attackers can identify administrator accounts without possessing the system:user:queryUserRole permission.

Recommendations Update to version 3.9.6 or later. Restrict access to the getUserRoleSetById handler in the 'SystemApiController' endpoint to users with the system:user:queryUserRole permission.