JeecgBoot versions up to 3.9.5 contain an endpoint /sys/api/getUserByName that fails to enforce proper authorization. A user that is authenticated, even with low privileges, can submit any username in a GET request and receive that user's stored password value. The response is returned encrypted with AES‑CBC, but a hard‑coded key can be obtained from /sys/getEncryptedString. Recovering that key allows the attacker to decrypt the response and obtain the plaintext password, exposing credentials that could be used for offline guessing. Based on the description, the primary consequence is disclosure of user credentials, including those of administrators.

The issue affects the JeecgBoot application on all deployments that use version 3.9.5 or earlier. The vulnerable code resides in SystemApiController for endpoint /sys/api/getUserByName.

The CVSS score of 7.1 indicates a high severity credential disclosure issue. No EPSS score is provided, so the probability of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits. The attack vector requires an authenticated user; the attacker would first log in, then request the vulnerable endpoint with a chosen username, and subsequently call /sys/getEncryptedString to obtain the encryption key. With the key the attacker can decrypt the password payload.