JeecgBoot through 3.9.5 implements a missing authorization check for the /sys/api/queryUserAuths endpoint, allowing authenticated users to supply any userId and view that user's full permission set. This means a low‑privileged attacker can enumerate the permissions of any account, including those belonging to administrators, thereby revealing the organization's privilege structure and potential attack vectors. The vulnerability is a classic case of improper authorization, categorized as an information disclosure flaw.

The affected product is JeecgBoot, with all releases up to and including version 3.9.5 vulnerable. No other versions or products are listed as affected.

The CVSS score of 5.3 places the vulnerability in the medium impact range. EPSS information is not available, and the vulnerability is not included in CISA’s KEV catalog, indicating that it has not yet been widely exploited in the wild. A required attack condition is that the attacker is an authenticated user; by supplying a crafted userId parameter to the queryUserAuths endpoint, the attacker can retrieve another user's permissions. The threat is therefore primarily the exposure of privileged information rather than the ability to execute code or achieve full system compromise.