EUVD-2026-96576

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...

CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

PT-2026-109898

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove members from user groups due to missing authorization. This is achieved by calling the 'DELETE /sys/user/deleteUserGroupBatch' endpoint. An attacker ca...