CVE-2026-108875

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController's addSysUserGroup handler. This vulnerability allows any authenticated user to perform unauthorized modifications to user group memberships by sending POST requests with arbitra...

EUVD-2026-97049

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...