CVE-2026-7602CWE-266CWE-285

JeecgBoot FillRuleUtil edit improper authorization

Medium · published May 2, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component FillRuleUtil Component. The manipulation of the argument ruleClass results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. You should upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00366 · 29.2th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-05-02T03:15Z
EPSS history
Timeline
  • 02 MAY 03:15Z
    JeecgBoot FillRuleUtil edit improper authorization
    cvelistv5