CVE-2026-108876

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the putCancelQuit handler of SysUserController. This flaw allows any authenticated user to cancel user resignations. By supplying specific user ids and a tenantId parameter (or X-Tenant-Id header), a l...