VULNERABILITY INTELLIGENCE
CVE-2026-78970
CVSS score6.5 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-862