JeecgBoot versions up to 3.9.5 expose a missing authorization flaw in the SystemApiController getUserRoleSetById endpoint. Any authenticated user can pass an arbitrary userId parameter and obtain that user's role assignments. The flaw, classified as CWE-862, allows attackers to gather sensitive data about user roles, including identifying accounts that hold administrative privileges, without requiring the system:user:queryUserRole permission.

JeecgBoot 3.9.5 and earlier releases from the jeecgboot project. The vulnerability resides in the SystemApiController within the jeecg-module-system, accessible via the /sys/api/getUserRoleSetById URL.

The CVSS score of 5.3 indicates a moderate risk. Because no EPSS score is available, the likelihood of exploitation in the wild is uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be local or network, requiring the attacker to be authenticated to the application. Once authenticated, low-privileged users can call the endpoint and discover other users’ role codes, which may be used to identify administrator accounts for further credential or privilege escalation attacks.