Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-108678

CVSS Base Score
4.3 MEDIUM
Primary Weakness
CWE-862
Published Date
Oct 10, 2026
Data Source
NVD API

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.

Related Vulnerabilitiesvia CWE-862

CVE-2026-340537.1 HIGH

Missing Authorization in OpenEMR AJAX endpoint 'handle_deletions.php' before 8.0.0.3. Allows any authenticated user to irreversibly delete procedure orders and specimens for any patient.

CWE-862
CVE-2026-42618.8 HIGH

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

CWE-862
CVE-2026-36515.3 MEDIUM

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.

CWE-862
CVE-2026-36455.3 MEDIUM

The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.

CWE-862
CVE-2026-33355.3 MEDIUM

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.

CWE-862
CVE-2026-29418.8 HIGH

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.

CWE-862

Is your system affected?

Precogs AI detects CVE-2026-108678 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo