CVE-2026-108881

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getTenantPackInfo handler. This vulnerability allows any authenticated user to access product pack membership data belonging to other tenants. By supplying a specific tenantId and fixed packCode values (such as...