What’s Vulnerable › Vulnerabilities

CVE-2026-7604: JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-02 · updated 2026-06-17
• Weakness: CWE-918

Description

A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.

Affected products

• JeecgBoot: 3.9.0, 3.9.1

References

• https://github.com/jeecgboot/JeecgBoot/
• https://github.com/jeecgboot/JeecgBoot/issues/9554
• https://github.com/jeecgboot/JeecgBoot/issues/9554#issuecomment-4251574151
• https://vuldb.com/submit/805708
• https://vuldb.com/vuln/360561
• https://vuldb.com/vuln/360561/cti

Get alerted when CVE-2026-7604 or the next vulnerability affects your stack