EUVD-2026-96598

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

CVE-2026-108659

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the SysTenantController's listPackByTenantUserId handler. This flaw allows any authenticated user to query tenant product packs by supplying arbitrary tenantId and userId parameters. Consequently, low-privil...