---
id: CVE-2026-58377
title: >-
  JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management
  Endpoints Exposes Access/Secret Keys
summary: >-
  JeecgBoot through 3.9.2 contains a broken access control vulnerability that
  allows authenticated low-privilege users to perform full create, read, update,
  and delete operations on OpenAPI credentials by accessing the
  OpenApiAuthControlle…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: jeecgboot
product: JeecgBoot
affected:
  - JeecgBoot <= 3.9.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-30T17:06:37.284634Z'
exploitAvailable: true
published: '2026-06-30'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:00.179Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58377'
references:
  - url: 'https://github.com/jeecgboot/JeecgBoot/issues/9705'
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/jeecgboot-missing-authorization-on-openapi-credential-management-endpoints-exposes-access-secret-keys
tags:
  - cve.org
  - exploit-available
epss: 0.00363
epssPercentile: 0.30385
ingestedAt: '2026-11-08T14:51:22.296Z'
---

## Overview

JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.

## Affected

- `JeecgBoot <= 3.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.