Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-8196: JeecgBoot 3.9.1: Unauthorized Access to Login Endpoint

CVE-2026-8196 · published 5 months ago

Summary

A security flaw in JeecgBoot 3.9.1 allows an attacker to bypass login authorization, potentially gaining access to the system. This vulnerability can be exploited remotely, and exploit code is publicly available. It's recommended to update to the latest version of JeecgBoot to mitigate this risk.

Original advisory text

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-285Improper Authorization

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published9 May 2026

Updated4 Nov 2026

First seen9 May 2026

Sources

CVE-2026-8196 · NVD

Track software like this

Free during beta