CVE-2026-11464 | JeecgBoot up to 3.9.2 User List Endpoint SysUserController.java queryPageList salt information disclosure (Issue 9648)

A vulnerability, which was classified as problematic, has been found in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file srcmainjavaorgjeecgmodulessystemcontrollerSysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure.

This vulnerability is listed as CVE-2026-11464. The attack may be initiated remotely. In addition, an exploit is available.

A fix is planned for the upcoming release.