CVE-2026-108882

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

CVE-2026-108882

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController removeUserPosition handler. This vulnerability allows any authenticated user to detach users from positions by sending DELETE requests with arbitrary userIds and positionId values, which d...