The vulnerability is a missing authorization fault (CWE-862) in the queryUserRoles handler of JeecgBoot's SystemApiController. The flaw allows any authenticated user to perform GET requests to the /sys/api/queryUserRoles endpoint with any username, which reveals the roles assigned to that user. Exposing role information can help an attacker map privilege assignments, identify administrator accounts, and plan further attacks.

JeecgBoot products running version 3.9.5 or earlier are affected. Users of the open‑source JeecgBoot application should verify that their installation is at or above the version where the exploit has been patched.

The CVSS score of 5.3 reflects a moderate level of risk. Because the endpoint requires only authentication, a low‑privileged attacker can abuse the flaw. The EPSS score is not provided, and the vulnerability is not listed in CISA's KEV catalog, so exploitation is not currently documented. Nonetheless, the attack path is straightforward: the attacker authenticates to the system, sends a GET request to /sys/api/queryUserRoles with an arbitrary username, and receives the role codes. This allows role enumeration and aids privilege escalation.