JeecgBoot up to version 3.9.5 contains a missing authorization flaw in the queryUserRolesById handler of SystemApiController. When an authenticated user issues a GET request to /sys/api/queryUserRolesById with a target userId, the application returns the set of role codes assigned to that user. This allows the attacker to discover which users hold privileged or administrator roles, providing actionable information that can be leveraged for further attacks such as privilege escalation or credential reuse.

The vulnerability affects JeecgBoot products from the Jeecg:JeecgBoot vendor, specifically all releases up to and including 3.9.5. No higher or lower boundary versions are explicitly listed, but any installation that has not been upgraded beyond 3.9.5 remains at risk.

The calculated CVSS score is 5.3, indicating a medium severity. The EPSS score is unavailable, and CISA has not listed the issue in KEV. Attackers must first be authenticated to the system; the flaw provides no pre‑authentication vector. Once authenticated, the attacker can enumerate role assignments with a single HTTP request, but the vulnerability does not allow arbitrary data exfiltration or code execution.