CVE-2026-108662

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the /sys/tenant/deleteTenantPackUser endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by supplying arbitrary userId and packId values in a PUT re...

CVE-2026-108660

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) accessible via the PUT /sys/tenant/updateApplyStatus endpoint. This flaw allows any authenticated user to modify tenant settings by supplying an arbitrary tenant ID to overwrite the applyStatus fiel...

CVE-2026-108661

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the /sys/tenant/changeOwenUserTenant endpoint. This vulnerability allows any authenticated user to perform unauthorized tenant ownership transfers by supplying specific userId and tenantId parameters via a POST req...

CVE-2026-108659

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the SysTenantController's listPackByTenantUserId handler. This flaw allows any authenticated user to query tenant product packs by supplying arbitrary tenantId and userId parameters. Consequently, low-privil...

CVE-2026-108658

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability (CWE-862) within the SysTenantController queryTenantAuthInfo handler. This flaw allows any authenticated user to access and read records belonging to other tenants. By iterating through small integer tenant ...

CVE-2026-108657

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysTenantController passApply handler. This security weakness allows any authenticated user to approve tenant administrator applications. Specifically, an attacker can submit a pending application using doApply...

CVE-2026-108656

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) within the SysTenantController at the GET /sys/tenant/getTenantPackApplyUsers endpoint. This vulnerability allows any authenticated user to access and read tenant administrator applications. By iterating the...

CVE-2026-108655

The JeecgBoot framework (versions through 3.9.5 ) is vulnerable to a missing authorization flaw in the QuartzJobController queryById handler. This allows low-privileged authenticated users to perform a GET /sys/quartzJob/queryById request to access restricted administrative data. Exploitation of ...

CVE-2026-108654

JeecgBoot versions up to and including 3.9.5 are affected by a missing authorization vulnerability in the OssFileController queryById handler. This flaw allows low-privileged authenticated users to access records belonging to other users by requesting GET /sys/oss/file/queryById with a known reco...

CVE-2026-108653

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability within the queryPageList handler of the OpenApiController component. This flaw allows any authenticated user to perform a GET /openapi/list request to access OpenAPI registry definitions. Successful exploitatio...

CVE-2026-108652

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController updateAvatar handler. This security weakness allows any authenticated user to modify the avatars of other users, including administrators. A low-privileged attacker can exploit this by sendi...

CVE-2026-108650

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getUserPermissionSet handler of the SystemApiController component. An authenticated, low-privileged attacker can exploit this by supplying an arbitrary userId to the GET /sys/api/getUserPermissionSet endpoint. ...

CVE-2026-108651

The JeecgBoot framework, version 3.9.5 and below, is vulnerable to a missing authorization flaw in the getRolesByUserId handler of the SystemApiController . This vulnerability allows authenticated users to bypass authorization checks by supplying arbitrary userId values via a GET request to /sys/...

CVE-2026-108649

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the queryUserRolesById handler of the SystemApiController component. This vulnerability allows authenticated users to access the /sys/api/queryUserRolesById endpoint and retrieve the role codes of any user by p...

CVE-2026-108648

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of the SystemApiController . The root cause is the lack of Shiro permission or role annotations , allowing any authenticated low-privileged user to exploit ...

CVE-2026-108647

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability within the SysCheckRuleController importExcel handler. This flaw allows low-privileged authenticated users to bypass the system:checkRule:add permission by uploading a crafted Excel workbook . Successful exp...

CVE-2026-108646

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController importExcel handler. This vulnerability allows any authenticated user to upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, includi...

CVE-2026-108645

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController component. This vulnerability allows any authenticated user to access the /sys/category/edit endpoint. By sending POST or PUT requests with a specific node ID, low-privileged attackers ...

CVE-2026-108643

JeecgBoot through version 3.9.5 is vulnerable to a missing authorization flaw (CWE-862). This allows low-privileged authenticated users to perform unauthorized deletions of category dictionary entries via the DELETE /sys/category/deleteBatch endpoint. Attackers can identify target node IDs using ...

CVE-2026-108644

JeecgBoot versions up to 3.9.5 are vulnerable to a missing authorization vulnerability in the SysCategoryController delete handler. This flaw allows any authenticated user to delete category dictionary nodes. Attackers with low privileges can identify target node IDs via the unguarded rootList an...