Vulnerability Description
A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/jeecgboot/JeecgBoot/
- https://github.com/jeecgboot/JeecgBoot/issues/9596
- https://github.com/jeecgboot/JeecgBoot/issues/9596#issuecomment-4385414813
- https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2
- https://vuldb.com/submit/817891
- https://vuldb.com/vuln/365635
- https://vuldb.com/vuln/365635/cti
- https://github.com/jeecgboot/JeecgBoot/issues/9596
FAQ
What is CVE-2026-9579?
CVE-2026-9579 is a vulnerability with a CVSS score of 6.3 (MEDIUM). A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument us...
How severe is CVE-2026-9579?
CVE-2026-9579 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9579?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.