CVE-2026-108662

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

PT-2026-109923

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove users from tenant product packs due to missing authorization. By sending a request to the 'PUT /sys/tenant/deleteTenantPackUser' endpoint, an attacker...