EUVD-2026-97046

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

CVE-2026-108872

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the batchEditUsers handler of the SysUserController. This vulnerability allows any authenticated user to send PUT requests to /sys/user/batchEditUsers using arbitrary user and department IDs. Consequent...