JeecgBoot versions 3.9.5 and earlier have a missing authorization flaw in the SysUserController queryChildrenByUsername endpoint. This flaw allows any authenticated user to request the records of other users, resulting in the disclosure of names, emails, phone numbers, employee numbers, department assignments, and lists of staff within departments headed by those users. The vulnerability stems from improper enforcement of access control for this operation.

The flaw affects the JeecgBoot application, specifically the SysUserController component up to and including version 3.9.5. Systems running any build of JeecgBoot <=3.9.5 that expose the /sys/user/queryChildrenByUsername API are vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated session; therefore an attacker with low privileges can misuse the endpoint to gather sensitive personal and structural information. Due to the lack of an explicit exploitation condition beyond authentication, the risk is primarily data exposure and potential fraud or social engineering rather than system compromise.