Missing Authorization Flaw in JeecgBoot Object Storage Controller
CVE-2026-108654

5.3MEDIUM

Key Information:

Vendor

Jeecgboot

Status
Jeecgboot
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-108654?

JeecgBoot version 3.9.5 is vulnerable due to a missing authorization issue in the OssFileController's queryById handler. This flaw permits low-privileged authenticated users to access object storage file records that should be restricted. By knowing the ID of the record, attackers can exploit this vulnerability to retrieve original file names and direct storage URLs associated with files uploaded by other users through a GET request to /sys/oss/file/queryById.

Affected Version(s)

JeecgBoot 0 <= 3.9.5

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe19...
technical-description
https://www.vulncheck.com/advisories/jeecgboot-through-3....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.