CVE-2026-108674: JeecgBoot Authorization Bypass Vulnerability

CVE-2026-108674 Overview

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability [CWE-862] in the OpenApiController.queryById handler. Low-privileged authenticated users can read OpenAPI definitions without holding the required openapi permission. Attackers send a GET /openapi/queryById request with an entry id to retrieve internal origin URLs, virtual paths, IP whitelists, and header and parameter templates. This information exposes gateway routing configuration that supports further attacks against protected backend services.

Critical Impact

Authenticated attackers with minimal privileges can enumerate OpenAPI gateway configurations, obtaining the routing metadata and whitelist controls needed to reach internal services.

Affected Products

• JeecgBoot versions up to and including 3.9.5
• jeecg-module-system component containing OpenApiController
• Deployments exposing the /openapi/queryById endpoint to authenticated users

Discovery Timeline

• 2026-10-10 - CVE-2026-108674 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108674

Vulnerability Analysis

The flaw sits in the queryById method of OpenApiController within the jeecg-module-system module. The handler returns full OpenAPI entry definitions when any authenticated session calls the endpoint. The controller does not verify that the caller holds the openapi role or permission scope associated with gateway administration. As a result, the authorization check that should gate configuration disclosure is absent, matching the Common Weakness Enumeration pattern for Missing Authorization [CWE-862].

The returned object includes internal origin URLs, virtual path mappings, IP allow lists, and templated request headers and parameters. Together these reveal how the OpenAPI gateway proxies traffic to internal services. Attackers use this data to craft requests that match whitelist conditions and reach systems not intended for external access.

Root Cause

The controller method omits a permission check before serving data from the OpenAPI configuration store. Jeecg's standard authorization annotations are not applied at the handler, so Spring Security processes only the baseline authenticated-session requirement. Any user issued a valid JWT, including self-registered or low-tier operational accounts, can invoke the route.

Attack Vector

Exploitation is network-based and requires low privileges with no user interaction. An attacker authenticates to the JeecgBoot instance, iterates integer id values against GET /openapi/queryById, and parses the JSON response. The public proof-of-concept chains this disclosure with calls to the gateway using harvested headers and whitelisted IP metadata. See the VulnCheck advisory on JeecgBoot and the JeecgBoot OpenApiController source for the vulnerable handler.

The vulnerability mechanism is described in prose because no sanitized exploit code is reproduced here. Readers can review the public proof-of-concept script for the full request sequence.

Detection Methods for CVE-2026-108674

Indicators of Compromise

• Authenticated GET requests to /openapi/queryById from accounts without the openapi role
• Sequential enumeration patterns against the id query parameter from a single session or token
• Follow-on requests to gateway routes using header and parameter values that mirror OpenAPI entry templates

Detection Strategies

• Correlate access logs to flag calls to /openapi/queryById where the authenticated principal lacks OpenAPI administration permissions
• Alert on short-interval repeated requests to the endpoint with incrementing id values
• Baseline normal callers of OpenAPI configuration endpoints and treat deviations as suspicious

Monitoring Recommendations

• Capture full request and response bodies for /openapi/* routes in a central log store for retrospective hunting
• Monitor outbound requests from the gateway to internal origin URLs for traffic originating from unexpected session IDs
• Track failed and successful authentication events on JeecgBoot instances alongside OpenAPI endpoint usage

How to Mitigate CVE-2026-108674

Immediate Actions Required

• Restrict network access to the JeecgBoot management interface and /openapi/* endpoints using a reverse proxy or WAF rule
• Audit existing user accounts and revoke tokens issued to low-privilege users who do not require OpenAPI access
• Review OpenAPI entries for sensitive origin URLs and rotate any IP whitelist entries or shared secrets that may have been exposed

Patch Information

No fixed version is listed in the NVD record at the time of publication. Track the JeecgBoot repository and the VulnCheck advisory on JeecgBoot for the official patch covering OpenApiController.queryById.

Workarounds

• Add an authorization annotation or interceptor that requires the openapi permission before queryById executes
• Block external access to /openapi/queryById at the ingress controller until an official fix is applied
• Enforce strict role assignment during user provisioning so new accounts cannot reach OpenAPI configuration routes

# Example nginx rule to deny direct access to the vulnerable endpoint
location = /openapi/queryById {
    deny all;
    return 403;
}