The flaw arises in JeecgBoot’s SysUser component when the user.getUsername function processes the userIdentity argument. An attacker can manipulate this argument to bypass the intended access checks, allowing unauthorized operations or data access that should be restricted to authenticated users. The vulnerability is classified as a medium severity issue (CVSS 5.3) and carries the risk of unauthorized account access, potentially leading to confidentiality and integrity violations for affected users.

JeecgBoot versions up to and including 3.9.1 are affected, specifically the userEdit endpoint located at /sys/user/login/setting/userEdit. The fix is available in version 3.9.2 and later releases. The affected component is JeecgBoot.

The exploit can be launched remotely, and a public exploit exists, meaning attackers could target vulnerable instances over the network. The EPSS score is not available, but the CVSS rating of 5.3 indicates a moderate risk. The vulnerability is not listed in CISA’s KEV catalog, but the publicly available exploit and the potential for unauthorized access underscore the need for timely remediation. Attackers would likely send crafted HTTP requests to the userEdit API, supplying a manipulated userIdentity value to impersonate another user or elevate privileges.