High severity7.3NVD Advisory· Published Nov 12, 2026· Updated Nov 12, 2026

CVE-2026-126998

Description

A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jeecg/Jeecgbootllm-create
Range: <=3.9.5

Patches

Vulnerability mechanics

References

github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-02-openapi-options-auth-bypass.mdnvd
vuldb.com/cve/CVE-2026-126998nvd
vuldb.com/submit/1040929nvd
vuldb.com/vuln/436297nvd
vuldb.com/vuln/436297/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000