Vulnerability · Published May 24, 2026 · Assigned by VulDB

CVE-2026-9373JeecgBoot OpenAPI Endpoint call improper authentication

Low 3.7

In plain English

A low-severity improper authentication in JeecgBoot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 70.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Such manipulation leads to improper authentication. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	JeecgBoot	3.9.1

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

References

VDB-365337 | JeecgBoot OpenAPI Endpoint call improper authentication vdb-entry
VDB-365337 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #813251 | jeecgboot JeecgBoot 3.9.1 Improper Authentication third-party-advisory