CVE-2026-108882

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

CVE-2026-108882

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController removeUserPosition handler. This vulnerability allows any authenticated user to detach users from positions by sending DELETE requests with arbitrary userIds and positionId values, which d...

EUVD-2026-97056

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

CVE-2026-108882 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

CVE-2026-108882 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

CVE-2026-108883 JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or...

CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108881

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getTenantPackInfo handler. This vulnerability allows any authenticated user to access product pack membership data belonging to other tenants. By supplying a specific tenantId and fixed packCode values (such as...

EUVD-2026-97055

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108881

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

EUVD-2026-97054

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the PUT /sys/dict/editDictByLowAppId endpoint. This vulnerability allows any authenticated user to modify low-code application dictionaries by providing a low_app_id (which can be discovered via GET /sys/dict/list)...

CVE-2026-108880

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

EUVD-2026-97052

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and...

CVE-2026-108878 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and...