Auth bypass in Jeecgboot
CVE-2026-58377
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Jeecgboot — versions 0
Weakness classification (CWE)
References
- github.com/jeecgboot/JeecgBoot/issues/9705 (technical-description, exploit)
- www.vulncheck.com/advisories/jeecgboot-missing-authorization-on-openapi-credent… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58377?
- CVE-2026-58377 is a high-severity vulnerability in Jeecgboot, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-06-30.
- How severe is CVE-2026-58377?
- High severity. CVSS v3 base score is 8.1 out of 10.