CVE-2026-108882

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController removeUserPosition handler. This vulnerability allows any authenticated user to detach users from positions by sending DELETE requests with arbitrary userIds and positionId values, which d...