Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read of role data rules
Action: Apply patch
AI Analysis

Impact

A missing authorization check in the loadDatarule handler of SysRoleController allows any authenticated user to query role data rules. By sending a GET request to /sys/role/datarule/{permissionId}/{roleId}, an attacker can read rule names, columns, conditions, values and bound rule identifiers for any role, exposing sensitive configuration information.

Affected Systems

The vulnerability affects JeecgBoot versions up through 3.9.5. The exposed endpoint is /sys/role/datarule on the JeecgBoot system, which processes role-based data rule requests.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, and exploitation requires that the attacker be already authenticated. Although it cannot be used for remote code execution, it permits information disclosure of role rule data that could aid further attacks.

Generated by OpenCVE AI on October 11, 2026 at 00:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade JeecgBoot to 3.9.6 or later where the missing authorization is corrected. If a new release is not yet available, contact the vendor for a patch or hotfix.
  • Restrict access to the /sys/role/datarule endpoint by configuring role-based permissions so that only users with appropriate authority can request rule data.
  • Regularly review and audit access logs for unusual queries to the /sys/role/datarule endpoint to detect potential abuse.

Generated by OpenCVE AI on October 11, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecg-boot
Vendors & Products Jeecg jeecg-boot

Sat, 10 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.
Title JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-862
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg-boot Jeecg Boot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T12:03:17.500Z

Reserved: 2026-10-10T20:18:18.686Z

Link: CVE-2026-108627

cve-icon Vulnrichment

Updated: 2026-10-18T11:54:44.794Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T22:16:37.450

Modified: 2026-10-18T12:16:58.433

Link: CVE-2026-108627

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T05:15:16Z

Weaknesses