CVE-2026-11458: JeeWMS Boot Actuator Information Disclosure Vulnerability

Technical summary

CVE-2026-11458 is an information disclosure vulnerability affecting the Boot Actuator Endpoint component in erzhongxmu JeeWMS. The flaw stems from insufficient access controls (CWE-284) and improper information handling (CWE-200) in the /base-boot/actuator endpoint. The vulnerability is network-accessible, requires no authentication or user interaction, and operates in a manner that suggests the endpoint may expose internal system state or configuration data that should remain restricted. The affected component is part of the application's boot and management infrastructure, which typically handles sensitive operational metadata. JeeWMS uses a rolling release model, complicating version tracking and patch correlation.

Business impact

Information disclosure through this endpoint could expose internal system architecture, configuration details, or operational metadata to attackers. For organizations relying on JeeWMS for warehouse management, this breach of confidentiality may compromise compliance posture if sensitive business or customer data is inadvertently revealed. The public availability of exploit code increases attack surface exposure, particularly for internet-facing JeeWMS instances. While direct system compromise is not possible via this vector, the disclosed information could facilitate secondary attacks or social engineering efforts.

Affected systems

erzhongxmu JeeWMS up to and including commit 141740afb2ba14d441c82a833d0a418d07ca2d69 is affected. The rolling release delivery model means version numbers are not tracked, making it difficult to determine patch status based on traditional versioning. Organizations must rely on commit hash or actual testing to verify remediation. Any JeeWMS instance with the /base-boot/actuator endpoint accessible over a network should be considered potentially vulnerable until confirmed patched.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication is required, no special conditions must be met, and the attack is trivial to execute remotely—an unauthenticated actor can probe the endpoint directly via HTTP. Public exploit code availability significantly increases the probability of automated scanning and attack attempts. The CVSS score of 5.3 reflects the network accessibility and lack of prerequisite conditions, though impact is limited to confidentiality.

Remediation

Organizations should update JeeWMS to a patched version beyond commit 141740afb2ba14d441c82a833d0a418d07ca2d69. Given the rolling release model, verify the current commit hash in your deployment and compare against vendor advisories or pull the latest build if available. Alternatively, restrict network access to the /base-boot/actuator endpoint using a Web Application Firewall (WAF), reverse proxy, or network segmentation until a verified patch is deployed. Disable or remove the Boot Actuator Endpoint if it is not required for operations.

Patch guidance

Verify the current commit of your JeeWMS deployment. Check erzhongxmu's official repository or advisory channels for confirmation that your running version is at or beyond a patched commit post-141740afb2ba14d441c82a833d0a418d07ca2d69. Because JeeWMS uses rolling releases without traditional version numbers, pull the latest main branch or release tag and test in a staging environment before production deployment. Document the commit hash after patching for audit purposes.

Detection guidance

Monitor for HTTP requests to /base-boot/actuator endpoints, particularly those from external or untrusted networks. Log and alert on successful responses from this path. If your JeeWMS instance exposes this endpoint, review recent access logs for reconnaissance activity. Network-based detection should flag any attempts to access management or actuator endpoints from unexpected sources. Application Performance Monitoring (APM) tools can help identify unusual data exfiltration patterns following endpoint access.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt remediation due to public exploit availability and the low attack complexity. Information disclosure from management endpoints can facilitate lateral movement or social engineering. The lack of vendor responsiveness and reliance on rolling releases means patches may be delayed or difficult to track, increasing the window of exposure. For internet-facing JeeWMS instances, this should be addressed within 1–2 weeks.

Risk score, explained

The CVSS:3.1 score of 5.3 (MEDIUM) reflects network accessibility and no authentication requirement (AV:N, PR:N, UI:N), resulting in a moderate impact to confidentiality (C:L). Integrity and availability are not affected (I:N, A:N), and the scope is unchanged (S:U). The score appropriately captures the risk of information disclosure without systemic compromise, but does not account for the downstream risk amplification from public exploits or the operational friction of rolling releases.

Frequently asked questions