The vulnerability arises from missing fine‑grained permission checks in the SystemApiController component of JeecgBoot. An attacker who holds any valid JWT token can call several admin‑level API endpoints, such as queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds. These calls return the entire set of user records, revealing real names, phone numbers, email addresses, employee identifiers and role definitions. The result is a complete compromise of user confidentiality, enabling data theft and identity misuse.

JeecgBoot version 3.9.2 and any earlier releases are affected. The issue lies solely in the SystemApiController functionality and does not appear in later versions. No specific vendor or distribution is listed beyond the JeecgBoot project itself.

The flaw requires an authenticated session; the attacker must have a working JWT token, meaning either legitimate credentials or possession of stolen tokens. Once authenticated, the attacker can retrieve all sensitive user details with a single authenticated request. Because no exploit has been reported in KEV and the EPSS score is unknown, the public exploitation likelihood may be moderate, yet the confidentiality impact is high. The CVSS score is 6.5, so administrators should treat this as a high‑risk disclosure pending patching.