EUVD-2026-96596

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT...

CVE-2026-108657

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysTenantController passApply handler. This security weakness allows any authenticated user to approve tenant administrator applications. Specifically, an attacker can submit a pending application using doApply...