CVE-2026-9579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9579", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-26T12:50:05.008Z", "datePublished": "2026-05-26T19:45:09.078Z", "dateUpdated": "2026-05-27T14:01:29.812Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-26T19:45:09.078Z"}, "title": "JeecgBoot SysUser userEdit user.getUsername access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "n/a", "product": "JeecgBoot", "versions": [{"version": "3.9.0", "status": "affected"}, {"version": "3.9.1", "status": "affected"}, {"version": "3.9.2", "status": "unaffected"}], "cpes": ["cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"], "modules": ["SysUser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-05-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-26T14:55:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "AliceS614 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/365635", "name": "VDB-365635 | JeecgBoot SysUser userEdit user.getUsername access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365635/cti", "name": "VDB-365635 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/817891", "name": "Submit #817891 | JeecgBoot 3.9.1 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596#issuecomment-4385414813", "tags": ["issue-tracking"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2", "tags": ["patch"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/", "tags": ["product"]}]}, "adp": [{"references": [{"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T14:00:45.628073Z", "id": "CVE-2026-9579", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:01:29.812Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9579", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T14:00:45.628073Z"}}}], "references": [{"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:00:30.634Z"}}], "cna": {"title": "JeecgBoot SysUser userEdit user.getUsername access control", "credits": [{"lang": "en", "type": "reporter", "value": "AliceS614 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["SysUser"], "product": "JeecgBoot", "versions": [{"status": "affected", "version": "3.9.0"}, {"status": "affected", "version": "3.9.1"}, {"status": "unaffected", "version": "3.9.2"}]}], "timeline": [{"lang": "en", "time": "2026-05-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-26T14:55:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/365635", "name": "VDB-365635 | JeecgBoot SysUser userEdit user.getUsername access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365635/cti", "name": "VDB-365635 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/817891", "name": "Submit #817891 | JeecgBoot 3.9.1 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/issues/9596#issuecomment-4385414813", "tags": ["issue-tracking"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2", "tags": ["patch"]}, {"url": "https://github.com/jeecgboot/JeecgBoot/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-26T19:45:09.078Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9579", "state": "PUBLISHED", "dateUpdated": "2026-05-27T14:01:29.812Z", "dateReserved": "2026-05-26T12:50:05.008Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-26T19:45:09.078Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"], "modules": ["SysUser"], "product": "JeecgBoot", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.9.0"}, {"status": "affected", "version": "3.9.1"}, {"status": "unaffected", "version": "3.9.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en JeecgBoot hasta la versi\u00f3n 3.9.1. Afectada es la funci\u00f3n user.getUsername del archivo /sys/user/login/setting/userEdit del componente SysUser. La manipulaci\u00f3n del argumento userIdentity resulta en controles de acceso inadecuados. El ataque puede ser lanzado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser utilizado. Se recomienda actualizar a la versi\u00f3n 3.9.2 para abordar este problema. El componente afectado deber\u00eda ser actualizado."}], "id": "CVE-2026-9579", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9579", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T14:00:45.628073Z", "version": "2.0.3"}}]}, "published": "2026-05-26T21:16:44.980", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/jeecgboot/JeecgBoot/"}, {"source": "cna@vuldb.com", "url": "https://github.com/jeecgboot/JeecgBoot/issues/9596"}, {"source": "cna@vuldb.com", "url": "https://github.com/jeecgboot/JeecgBoot/issues/9596#issuecomment-4385414813"}, {"source": "cna@vuldb.com", "url": "https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/817891"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365635"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365635/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jeecgboot/JeecgBoot/issues/9596"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.9.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.9.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "JeecgBoot", "source": "cna", "vendor": "n/a"}, "product": "jeecgboot", "vendor": "jeecgboot"}], "created": "2026-05-26T22:00:15.766793+00:00", "updated": "2026-05-26T23:45:05.979293+00:00", "vendors": ["jeecgboot", "jeecgboot$PRODUCT$jeecgboot"]}