EUVD-2026-96576

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...