CVE-2026-58377: JeecgBoot OpenAPI Credential Access Control Vulnerability

Technical summary

CVE-2026-58377 exploits missing Shiro authorization annotations on the OpenApiAuthController and OpenApiPermissionController endpoints in JeecgBoot through version 3.9.2. The broken access control (CWE-862) permits authenticated users without administrative privileges to execute unrestricted CRUD operations against API credentials. The vulnerability stems from insufficient permission validation at the endpoint level, allowing credential enumeration, creation, modification, and deletion. The plaintext return of secret keys in list operations compounds the risk by enabling direct credential exfiltration.

Business impact

Organizations running JeecgBoot for API management face exposure of all stored API credentials to any authenticated user, regardless of role. An attacker with low-level access—such as a contractor, junior developer, or compromised account—can steal production API keys and use them to invoke backend APIs, potentially accessing sensitive data, modifying critical business processes, or pivoting to connected systems. This breaks the security boundary between user privilege levels and creates significant insider threat and privilege escalation vectors.

Affected systems

JeecgBoot versions through 3.9.2 are affected. The vulnerability impacts any deployment where OpenAPI credential management is used and multiple users or roles have access to the JeecgBoot platform. Organizations should verify their currently deployed version and check for available security updates from the vendor.

Exploitability

Exploitation requires valid user credentials and network access to the JeecgBoot instance. No specialized tools or zero-day techniques are needed; standard HTTP requests to the unprotected endpoints suffice. The low complexity and lack of user interaction (UI:N) make this vulnerability straightforward to exploit once an attacker has authenticated access. The CVSS score of 8.1 (HIGH) reflects the high impact on confidentiality and integrity of credential data.

Remediation

Upgrade JeecgBoot to a patched version released after 3.9.2 that includes Shiro authorization annotations on the OpenApiAuthController and OpenApiPermissionController endpoints. Verify against the vendor's official advisory for specific patch version numbers. Until patching is possible, restrict authentication access to JeecgBoot through network segmentation, limit low-privilege user access to only essential functionality, and rotate all API credentials to invalidate those potentially exposed.

Patch guidance

Contact the JeecgBoot development team or check the official project repository for a security update addressing the missing authorization annotations. Verify the patch version in the vendor advisory before deployment. Apply patches in a test environment first to ensure compatibility with your specific JeecgBoot configuration. After patching, audit all API credentials for unauthorized activity or exposure.

Detection guidance

Monitor access logs to the OpenApiAuthController and OpenApiPermissionController endpoints for unusual patterns: requests from low-privilege users, bulk credential listing or deletion, and repeated credential read operations outside normal business workflows. Query your OpenAPI credential store for unexpected changes in ownership, creation time, or access patterns. Search security logs for authentication of users followed immediately by calls to credential management endpoints. Alerting on any list operation returning plaintext secrets is a strong indicator of credential exposure attempts.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.1), direct exposure of plaintext credentials, and ease of exploitation by low-privilege users. The broken access control affects the core integrity of API credential management, a sensitive security function. The lack of a KEV entry does not diminish urgency; organizations should treat this as a critical internal threat vector and prioritize patching accordingly.

Risk score, explained

The CVSS:3.1 score of 8.1 reflects: network-accessible endpoint (AV:N), low attack complexity (AC:L), requirement for prior authentication (PR:L), no user interaction needed (UI:N), isolated scope (S:U), high confidentiality impact from plaintext secret theft (C:H), high integrity impact from credential manipulation (I:H), and no availability impact (A:N). The score appropriately captures the severity of unrestricted credential access but does not account for organizational context—internal threat landscape and downstream API attack surface may elevate perceived risk further.

Frequently asked questions