EUVD-2026-96599

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant...

CVE-2026-108660

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) accessible via the PUT /sys/tenant/updateApplyStatus endpoint. This flaw allows any authenticated user to modify tenant settings by supplying an arbitrary tenant ID to overwrite the applyStatus fiel...