PT-2026-36571 · Unknown · Jeecg-Boot

Ana10Gy · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7604

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.2

Description An issue in the OpenApi Service component allows remote attackers to perform server-side request forgery (SSRF), a flaw where the server is coerced into making unintended requests. This occurs through the manipulation of the originUrl argument within the 'OpenApiController.add' and 'OpenApiController.call' functions of the OpenApiController.java file.

Recommendations Upgrade the affected component to a version that contains the fix. As a temporary workaround, restrict access to the 'OpenApiController.add' and 'OpenApiController.call' functions.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7604

Affected Products

Jeecg-Boot

References · 8

• 🔥 https://github.com/jeecgboot/JeecgBoot/issues/9554 · Exploit
• https://github.com/jeecgboot/JeecgBoot/issues/9554#issuecomment-4251574151 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7604 · Security Note
• https://vuldb.com/submit/805708 · Note
• https://vuldb.com/vuln/360561/cti · Note
• https://github.com/jeecgboot/JeecgBoot · Note
• https://vuldb.com/vuln/360561 · Note
• https://twitter.com/VulmonFeeds/status/2050450985881944205 · Twitter Post