CVE-2026-58377
Last modified
CVE-2026-58377 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jeecgboot | JeecgBoot | <= 3.9.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-58377?
How severe is CVE-2026-58377?
How do I fix CVE-2026-58377?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-58371SeaweedFS before 4.30 reflects the callback query parameter …3.1
- CVE-2026-58372SeaweedFS before 4.34 contains a path traversal vulnerabilit…8.1
- CVE-2026-58373CVAT before 2.69.0 contains an improper authorization vulner…5.3
- CVE-2026-58374In hostapd before 2.12, a missing bounds check in AP-mode Wi…7.1
- CVE-2026-58375JimuReport through 2.5.0 exposes the POST /jmreport/auto/exp…8.7
- CVE-2026-58376Dolibarr through 23.0.3, fixed in commit 14db36e, contains a…7.6
- CVE-2026-58378Allwinner H616 TV Box TV98 has ADB enabled and exposed to th…8.8
- CVE-2026-58379A flaw was found in GIMP's Paint Shop Pro (PSP) file format …7.3
- CVE-2026-5838A vulnerability was determined in PHPGurukul News Portal Pro…4.7
- CVE-2026-58380A flaw was found in GIMP's PNM file format parser. When pars…7.8
- CVE-2026-58381A flaw was found in GIMP's PSP file format parser. A double-…6.1
- CVE-2026-58384A flaw was found in GIMP's PSD parser. An integer overflow i…7.8
Are you affected by CVE-2026-58377?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST