Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-108677

CVSS Base Score
6.5 MEDIUM
Primary Weakness
CWE-862
Published Date
Oct 10, 2026
Data Source
NVD API

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.

Related Vulnerabilitiesvia CWE-862

CVE-2026-340537.1 HIGH

Missing Authorization in OpenEMR AJAX endpoint 'handle_deletions.php' before 8.0.0.3. Allows any authenticated user to irreversibly delete procedure orders and specimens for any patient.

CWE-862
CVE-2026-42618.8 HIGH

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

CWE-862
CVE-2026-36515.3 MEDIUM

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.

CWE-862
CVE-2026-36455.3 MEDIUM

The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.

CWE-862
CVE-2026-33355.3 MEDIUM

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.

CWE-862
CVE-2026-29418.8 HIGH

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.

CWE-862

Is your system affected?

Precogs AI detects CVE-2026-108677 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo