CVE-2026-58377

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.3

Description Authenticated low-privilege users can perform full create, read, update, and delete operations on OpenAPI credentials. This occurs because the 'OpenApiAuthController' and 'OpenApiPermissionController' endpoints lack Shiro authorization annotations, which are used to enforce access control. An attacker can list, add, edit, and delete all AK/SK (Access Key/Secret Key) credential pairs. Furthermore, the list endpoint returns secret keys in plaintext, allowing for credential theft and unauthorized invocation of the OpenAPI surface.

Recommendations Update to a version newer than 3.9.2. Restrict access to the 'OpenApiAuthController' and 'OpenApiPermissionController' endpoints as a temporary mitigation.