ZeroDay Findings
Sign inSign up

Findings

CVE-2026-108655

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to r…

Published Oct 10, 2026 · updated Oct 14, 2026

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 10, 2026 · NIST NVD

    Detected

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.

  2. Oct 14, 2026 · NIST NVD

    Updated

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.

Sources

  • CVE.orgVulnerability recordCVE-2026-108655

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-108655

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-108655

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class

    nvd.nist.gov

References