CVE-2026-108882

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController removeUserPosition handler. This vulnerability allows any authenticated user to detach users from positions by sending DELETE requests with arbitrary userIds and positionId values, which d...

EUVD-2026-97056

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

EUVD-2026-96560

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests t...

EUVD-2026-96559

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108621

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController edit handler. This vulnerability allows any authenticated user to modify organizational positions by sending PUT or POST requests to the /sys/position/edit endpoint. A low-privileged attac...

CVE-2026-108620

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController deleteBatch handler. This vulnerability allows any authenticated user to delete organizational positions by sending comma-separated position IDs. Attackers can first obtain the...