CVE-2026-9579: JeecgBoot Auth Bypass Vulnerability

CVE-2026-9579 Overview

CVE-2026-9579 is an improper access control vulnerability [CWE-266] affecting JeecgBoot through version 3.9.1. The flaw resides in the user.getUsername function within the /sys/user/login/setting/userEdit endpoint of the SysUser component. Attackers can manipulate the userIdentity argument to bypass access controls remotely. The exploit details have been published, increasing the likelihood of opportunistic abuse against exposed instances. JeecgBoot has released version 3.9.2 to address the issue. Authenticated users with low privileges can leverage this weakness over the network without user interaction.

Critical Impact

Authenticated attackers can manipulate the userIdentity parameter to bypass access controls within the SysUser component, impacting confidentiality, integrity, and availability at a limited scope.

Affected Products

• JeecgBoot versions up to and including 3.9.1
• JeecgBoot SysUser component
• /sys/user/login/setting/userEdit endpoint exposed by the affected versions

Discovery Timeline

• 2026-05-26 - CVE-2026-9579 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9579

Vulnerability Analysis

The vulnerability exists in JeecgBoot's SysUser component, which handles user account settings. The user.getUsername function processes requests sent to /sys/user/login/setting/userEdit but fails to enforce proper access control on the userIdentity argument. An authenticated attacker can supply a manipulated userIdentity value to act on identities other than their own. This results in improper access controls categorized under [CWE-266] Incorrect Privilege Assignment. The attack requires network access and low privileges, but no user interaction. Public exploit details lower the technical barrier for opportunistic abuse.

Root Cause

The root cause is missing authorization validation between the authenticated session and the userIdentity parameter accepted by the endpoint. The application trusts client-supplied identity data instead of verifying that the requesting user owns the targeted account. This allows horizontal access to user settings outside the caller's authorization boundary.

Attack Vector

The attack is launched remotely against an exposed JeecgBoot instance. An authenticated user submits a crafted HTTP request to /sys/user/login/setting/userEdit with a manipulated userIdentity value. Because the published proof-of-concept describes the parameter handling, exploitation requires only standard HTTP tooling. See the JeecgBoot GitHub Issue #9596 for technical context.

No verified exploit code is published in a vetted repository, so this article describes the mechanism in prose rather than reproducing untrusted snippets.

Detection Methods for CVE-2026-9579

Indicators of Compromise

• HTTP requests to /sys/user/login/setting/userEdit containing userIdentity values that do not match the authenticated session identifier.
• Unexpected modifications to user profile settings for accounts other than the requesting user.
• Repeated userEdit requests from a single session referencing multiple distinct userIdentity values.

Detection Strategies

• Correlate web access logs with authentication logs to identify mismatches between session principals and userIdentity parameter values.
• Deploy WAF or reverse proxy rules that inspect the userIdentity argument and compare it to the session's user context.
• Review JeecgBoot audit logs for SysUser profile changes that lack a corresponding administrative action.

Monitoring Recommendations

• Forward JeecgBoot application logs to a centralized SIEM or data lake for cross-account anomaly detection.
• Alert on bursts of userEdit requests originating from low-privilege accounts.
• Track the JeecgBoot version inventory to confirm all instances are upgraded to 3.9.2 or later.

How to Mitigate CVE-2026-9579

Immediate Actions Required

• Upgrade all JeecgBoot deployments to version 3.9.2 or later, as recommended by the project maintainers.
• Restrict network exposure of the JeecgBoot administrative interface to trusted networks until patching completes.
• Audit existing user accounts and recent profile changes for unauthorized modifications.

Patch Information

The JeecgBoot maintainers fixed the issue in version 3.9.2. The patched release is available at the JeecgBoot v3.9.2 Release. Refer to the JeecgBoot GitHub Repository for upgrade guidance and to the VulDB Vulnerability #365635 entry for additional advisory details.

Workarounds

• Apply WAF rules that block requests to /sys/user/login/setting/userEdit where userIdentity does not match the authenticated session.
• Disable or restrict access to the SysUser self-service editing endpoint until the upgrade is deployed.
• Enforce least-privilege role assignments to limit the population of accounts that can reach the vulnerable endpoint.

# Example NGINX rule restricting access to the vulnerable endpoint to an internal admin network
location /sys/user/login/setting/userEdit {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://jeecgboot_backend;
}