EUVD-2026-96602

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to...

CVE-2026-108663

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysTenantController deleteApply handler. This vulnerability allows any authenticated user to perform actions intended for tenant administrators by sending PUT requests with arbitrary tenantId, packId, and userI...