CVE-2026-58377
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A broken access control vulnerability in JeecgBoot through version 3.9.2 allows authenticated low-privilege users full CRUD operations on OpenAPI credentials. The lack of Shiro authorization annotations in OpenApiAuthController and OpenApiPermissionController enables listing, adding, editing, and deleting all AK/SK pairs, with the list endpoint exposing secret keys in plaintext.
Risk Assessment
The risk includes credential theft and unauthorized invocation of the OpenAPI surface, potentially leading to data breaches, unauthorized resource access, and system integrity compromise.
Recommendation
Immediately upgrade JeecgBoot to the latest patched version that fixes the access control issue. Additionally, enforce proper Shiro authorization annotations on all OpenAPI endpoints.
Other vulnerabilities in JeecgBoot
See all- CVE-2026-67926Critical
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module.
- CVE-2026-75411Low risk· EPSS 13%
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
- CVE-2026-67925Medium
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload.
- CVE-2026-19000High
A vulnerability was identified in JeecgBoot up to 3.9.2 in an unknown function of the file /airag/chat/send of the Anonymous Chat Attachment Parser component, allowing server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-11502Low
An open redirect vulnerability was found in JeecgBoot up to version 3.9.2 in the Third-Party Login component. The attack requires social engineering and is difficult to exploit.
- CVE-2026-11464Low
An information disclosure vulnerability was found in JeecgBoot up to version 3.9.2 in the queryPageList function of SysUserController.java. Manipulating the 'salt' argument allows remote unauthorized data access.
- CVE-2026-10241Medium
In jeecgboot up to version 3.9.1, a server-side request forgery vulnerability exists in the FileDownloadUtils.download2DiskFromNet function of /airag/app/debug. The attack can be performed remotely and the exploit has been released. Version 3.9.2 fixes the issue.
- CVE-2026-10240Medium
In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in an unknown function of /airag/airagModel/test. Manipulation of the baseUrl argument allows remote attack. The exploit is publicly available.
- CVE-2026-10239Medium
In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in the WordUtil.addImage function of /airag/word/edit. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-9604Medium
In JeecgBoot up to version 3.9.1, a vulnerability in the AiragModelController component allows improper access controls via manipulation of list/queryById arguments. The attack can be executed remotely, and the exploit is public. Fixed in version 3.9.2.
Original NVD description (English source)
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.