CVE-2026-11464: JeecgBoot User List Information Disclosure via Salt Parameter

Technical summary

The queryPageList function in SysUserController.java fails to properly validate or restrict the salt argument supplied by authenticated users. This parameter manipulation leads to information disclosure (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) and represents a violation of access control boundaries (CWE-284: Improper Access Control). The vulnerability requires network access, valid user credentials, and moderately complex attack preparation, as reflected in the CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.

Business impact

While the CVSS score of 3.1 (LOW) reflects limited immediate damage potential, this vulnerability enables authenticated insiders or compromised user accounts to exfiltrate sensitive information without triggering data modification alerts. Organizations relying on JeecgBoot for access control or data segregation should assess whether the exposed information intersects with regulated data (PII, financial records, etc.), as the actual business impact may exceed the technical severity rating in compliance-sensitive environments.

Affected systems

JeecgBoot versions up to and including 3.9.2 are confirmed vulnerable. The vulnerability resides in the User List Endpoint component, making any deployment exposing this endpoint directly accessible to network users a potential target. Organizations should verify their JeecgBoot installation version and review which users and systems have network access to the User List API.

Exploitability

The vulnerability is rated HIGH in attack complexity and is difficult to exploit, yet a public exploit exists. This combination suggests the attack requires knowledge of the salt parameter's role and expected values, plus valid user authentication. The presence of public exploit code elevates the risk that adversaries with basic reconnaissance skills may eventually weaponize it, though active widespread exploitation is not typical for low-severity information disclosure flaws.

Remediation

Upgrade to the patched release once the vendor releases it (verify against official JeecgBoot release notes). Until then, restrict network access to the User List Endpoint via firewall rules or API gateway authentication policies to users who genuinely require it. Audit recent access logs for unusual salt parameter values in queryPageList requests. Consider rotating credentials for accounts with elevated privileges if prior unauthorized access is suspected.

Patch guidance

The vendor has announced a fix is planned for an upcoming release. Monitor the JeecgBoot project repository and security advisories for version announcements. When a patched version is published, validate the release notes confirm remediation of CVE-2026-11464. In testing environments, verify that the salt parameter is now properly validated and that information disclosure no longer occurs when malformed or unexpected values are supplied.

Detection guidance

Monitor access logs for the queryPageList endpoint (src/main/java/org/jeecg/modules/system/controller/SysUserController.java) and look for requests with unusual or repeated salt parameter values, particularly from unexpected user accounts or IP ranges. Correlate with any subsequent data access patterns that suggest sensitive information retrieval. Web application firewalls or API gateways can be configured to flag salt parameters outside expected formats or lengths.

Why prioritize this

Although the CVSS score is LOW, this vulnerability warrants attention for organizations with sensitive user or system data in JeecgBoot deployments. The existence of public exploit code and the ease of initial access (requiring only valid credentials) make it an attractive target for insider threats or post-compromise lateral movement. Prioritize patching if user account metadata, role information, or other administrative data is at risk.

Risk score, explained

CVSS 3.1 (LOW, score 3.1) reflects limited attack surface (requires authentication and high complexity), confined impact (confidentiality only, low scope), and no availability or integrity damage. However, the availability of public exploit code and the sensitivity of the User List Endpoint in access-control systems argue for treating this above baseline LOW-severity handling in environments where user enumeration or metadata leakage has compliance or operational consequences.

Frequently asked questions