JeecgBoot through 3.9.5 contains a missing authorization flaw in the getRolesByUserId handler of SystemApiController. The flaw allows an authenticated user to request any userId and receive that user's role codes. This enumeration can reveal which accounts hold administrative roles, thereby assisting attackers in planning privilege‑escalation or targeted attacks. The weakness is a missing authorization (CWE‑862).

JeecgBoot versions up to and including 3.9.5 are affected. The vulnerability exists in the core module that exposes /sys/api/getRolesByUserId. Only users who have logged into the application can leverage the endpoint.

The CVSS score is 5.3, indicating a low‑to‑moderate impact when combined with credentialed access. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated, so the exploitation vector is a legitimate login followed by a crafted GET request to /sys/api/getRolesByUserId. Since the flaw permits role enumeration, attackers may identify privileged accounts and potentially use other weaknesses to increase privileges.