CVE-2026-78970: JeecgBoot Authorization Bypass Vulnerability

CVE-2026-78970 Overview

CVE-2026-78970 is an authorization bypass vulnerability in JeecgBoot 3.9.2 and earlier. The flaw resides in the SystemApiController component, which fails to enforce fine-grained permission checks on several user-facing API endpoints. Any authenticated attacker holding a valid JSON Web Token (JWT) can invoke endpoints such as queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to enumerate sensitive account data. Returned records include real names, phone numbers, email addresses, employee numbers, and role definitions. Incomplete data desensitization amplifies the disclosure. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
An authenticated low-privilege user can harvest personally identifiable information (PII) and role assignments for every account in a JeecgBoot deployment, enabling targeted phishing, credential stuffing, and privilege mapping.

Affected Products

JeecgBoot 3.9.2
JeecgBoot versions earlier than 3.9.2
Deployments exposing the SystemApiController API surface

Discovery Timeline

2026-09-04 - CVE-2026-78970 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78970

Vulnerability Analysis

JeecgBoot exposes user directory operations through the SystemApiController. The controller authenticates callers by validating a JWT but does not check whether the caller holds the roles or scopes required to enumerate other users. The result is horizontal privilege escalation: any authenticated session can read data belonging to unrelated accounts, including administrators.

Because the endpoints return records intended for internal service-to-service use, sensitive fields are not fully redacted before serialization. Phone numbers, emails, and employee identifiers appear in plaintext responses.

The vulnerability enables reconnaissance that supports follow-on attacks. Attackers can map organizational hierarchy through returned role definitions and then target privileged accounts with tailored phishing or password-spraying campaigns.

Root Cause

The root cause is missing authorization enforcement on read paths within SystemApiController. Developers relied on JWT presence as an implicit trust boundary and omitted role-based access control checks on queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds. Data desensitization filters are also incomplete, so even sanitized responses expose PII fields.

Attack Vector

Exploitation requires network access to the JeecgBoot API and a valid JWT obtained through normal authentication. The attacker issues HTTP requests to the affected endpoints and parses the JSON responses to extract user records. No user interaction is required, and no elevated privileges are needed beyond a standard authenticated session. Technical details are tracked in JeecgBoot Issue #9670 and JeecgBoot Issue #9674.

No verified proof-of-concept code is publicly linked to this CVE. The vulnerability mechanism is described in prose above; see the referenced GitHub issues for endpoint-level detail.

Detection Methods for CVE-2026-78970

Indicators of Compromise

Repeated authenticated requests to /jeecg-boot/sys/api/queryAllUser, queryUsersByUsernames, queryUserById, or queryUsersByIds from a single JWT subject
Sequential or enumerated userId parameters in short time windows against queryUserById
Anomalously large response payloads from SystemApiController endpoints containing PII fields
Low-privilege service accounts issuing directory-wide user queries

Detection Strategies

Instrument the JeecgBoot application to log JWT subject, role claims, and endpoint path for every SystemApiController invocation
Baseline normal query volumes per role and alert on deviations, especially from non-administrative roles
Correlate authentication events with subsequent bulk user-enumeration API calls to identify reconnaissance patterns

Monitoring Recommendations

Forward JeecgBoot access logs and web application firewall (WAF) telemetry to a centralized analytics platform for retention and correlation
Create rules that flag any account touching more than a defined threshold of unique userId values within a rolling window
Monitor egress traffic for large JSON payloads originating from the JeecgBoot API tier to detect data exfiltration attempts

How to Mitigate CVE-2026-78970

Immediate Actions Required

Restrict network exposure of the JeecgBoot SystemApiController endpoints to trusted internal networks or service mesh peers
Audit issued JWTs and revoke tokens for inactive, service, or low-trust accounts pending a patch
Review recent access logs for enumeration patterns against the four affected endpoints and rotate credentials of any user whose data was disclosed

Patch Information

No fixed version was identified in the NVD record at the time of publication. Track remediation status through JeecgBoot Issue #9670 and JeecgBoot Issue #9674, and apply the vendor-supplied fix as soon as it becomes available.

Workarounds

Place a reverse proxy or API gateway in front of JeecgBoot and enforce role-based access control on /sys/api/queryAllUser, /sys/api/queryUsersByUsernames, /sys/api/queryUserById, and /sys/api/queryUsersByIds
Add a servlet filter or Spring interceptor that verifies administrative role claims in the JWT before delegating to SystemApiController methods
Apply response-body filtering at the gateway to strip phone, email, and workNo fields for non-privileged callers until a vendor patch is deployed

bash

# Example nginx snippet restricting SystemApiController endpoints to an internal subnet
location ~ ^/jeecg-boot/sys/api/(queryAllUser|queryUsersByUsernames|queryUserById|queryUsersByIds) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://jeecgboot_upstream;
}