The flaw is a missing authorization check in JeecgBoot’s SystemApiController that handles the /sys/api/getUserPermissionSet endpoint. An authenticated user can supply any userId in a GET request and obtain the full permission set for that account, including privileged administrator permissions. This does not provide executable code or direct control of the system, but it reveals sensitive authorization data that could be used to facilitate further attacks or privilege escalation. This weakness corresponds to CWE‑862: Missing Authorization.

JeecgBoot versions 3.9.5 and earlier suffer from this vulnerability. The affected component is the SystemApiController’s getUserPermissionSet handler, which processes the /sys/api/getUserPermissionSet path.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and involves sending an HTTP GET request to /sys/api/getUserPermissionSet with an arbitrary userId. While the attack does not grant code execution, the disclosed permission data could aid attackers in planning further privilege escalation or targeted exploits.