CyberRota Analysis
AI-GeneratedJeecgBoot versions 3.9.2 and earlier are vulnerable to an authorization bypass in the SystemApiController, allowing authenticated attackers with valid JWT tokens to access sensitive user information through multiple API endpoints. This vulnerability can lead to unauthorized disclosure of personal data, including real names, contact details, and role definitions. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.