Skip to content
Verified reproduction

CVE-2026-58377: JeecgBoot broken access control privilege escalation

CVE-2026-58377 is verified against jeecgboot/JeecgBoot · github affected versions: JeecgBoot through 3.9.2 (all versions up to and including 3.9.2) vulnerability class: Privilege Escalation This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00250.

REPRO-2026-00250 jeecgboot/JeecgBoot · github Privilege Escalation Variant found Jul 6, 2026 .txt
Severity HIGH
Confidence HIGH
Reproduced in 31m 46s
Tool calls 271
Spend $4.34
Affected JeecgBoot through 3.9.2 (all versions up to and including 3.9.2)
$ pruva-verify REPRO-2026-00250
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00250/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated users to escalate privileges. Reproduce: deploy JeecgBoot <=3.9.2, create a low-privileged user, and send requests to admin-only endpoints to perform privileged actions.

03 · Root cause
Variant analysis
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.