CVE-2026-108886 [MEDIUM] – JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserContr

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users’ account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.