EUVD-2026-96544

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

PT-2026-110194

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

CVE-2026-108876: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

PT-2026-109994

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

PT-2026-109991

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT BUSINESS TITLE READ can retrieve organization invoicing entities,...

PT-2026-109992

Name of the Vulnerable Software and Affected Versions 1Panel-dev CordysCRM versions prior to 1.9.2 Description An authorization flaw exists in the sortModule handler within the ContractController. The endpoint 'POST /contract/sort' lacks necessary permission annotations, allowing authenticated...

PT-2026-109986

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

PT-2026-109996

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

PT-2026-109999

Wukong HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards a...

PT-2026-109982

Name of the Vulnerable Software and Affected Versions Eladmin versions prior to 2.8 Description Low-privileged authenticated users can bypass the storage:add permission due to missing authorization in the uploadPicture handler of the LocalStorageController. By sending POST requests containing fil...

PT-2026-109983

Name of the Vulnerable Software and Affected Versions Wukong AICRM versions prior to 20260611 Description An authorization flaw allows authenticated users to write into the AI chat sessions of other users. By providing an arbitrary sessionId to the 'POST /chat/send' endpoint, an attacker can appe...

PT-2026-110202

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's low app id, obtained from GET /sys/dict/list, via the lowAppI...

PT-2026-110197

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...

PT-2026-110203

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the getTenantPackInfo handler. This issue allows an authenticated user to access product pack membership information belonging to other tenants. By providing a...

PT-2026-110170

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.11 Description An authorization flaw exists in the MCP server faq search tool. This occurs because the searchDatabase function fails to apply user or group permission checks. Consequently, clients connected to th...

PT-2026-110198

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the putCancelQuit handler of SysUserController. This issue allows any authenticated user to cancel user resignations. Low-privileged attackers can restore ended,...

PT-2026-110205

🚨 CVE-2026-108883 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of...

PT-2026-110199

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list...

PT-2026-110207

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys sms row, erasing records of sen...

PT-2026-110206

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...