Missing Authorization Vulnerability in JeecgBoot by Jeecg
CVE-2026-108648

7.1HIGH

Key Information:

Vendor

Jeecgboot

Status
Jeecgboot
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-108648?

JeecgBoot versions up to 3.9.5 are susceptible to a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of the SystemApiController. This flaw allows authenticated low-privileged users to exploit the absence of Shiro permission or role annotations. By supplying malicious datasource codes via the dbSourceCode parameter, these users can inadvertently access sensitive JDBC URLs, usernames, and decrypted cleartext database passwords, thus posing a significant threat to data integrity and security.

Affected Version(s)

JeecgBoot 0 <= 3.9.5

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe19...
technical-description
https://www.vulncheck.com/advisories/jeecgboot-through-3....
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.