JeecgBoot up to version 3.9.5 contains a missing authorization flaw in the SystemApiController’s GET /sys/api/getDynamicDbSourceByCode endpoint because it lacks Shiro permission or role annotations. An authenticated user with low privileges can supply a datasource code via the dbSourceCode parameter and receive the full JDBC URL, username, and decrypted cleartext password. This defect enables direct leakage of highly sensitive credential information, representing a classic Missing Authorization weakness (CWE‑862).

The vulnerability affects the JeecgBoot platform, specifically all releases through 3.9.5. Systems running JeecgBoot v3.9.5 or earlier are vulnerable. The issue is mitigated in later releases where proper authorization annotations are added to the endpoint.

The flaw has a CVSS score of 7.1, reflecting moderate to high severity. The EPSS score is not available, but the attack vector requires only authenticated access, which is commonly present in many environments. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. An attacker would need to authenticate, then send a GET request to /sys/api/getDynamicDbSourceByCode with a valid dbSourceCode, after which they would obtain the datasource’s JDBC URL, username, and cleartext password, enabling immediate credential misuse.