CVE-2026-108876

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

CVE-2026-108876 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

CVE-2026-108876 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

CVE-2026-108876 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

EUVD-2026-97050

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

CVE-2026-108876

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the putCancelQuit handler of SysUserController. This flaw allows any authenticated user to cancel user resignations. By supplying specific user ids and a tenantId parameter (or X-Tenant-Id header), a l...

CVE-2026-108876

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

CVE-2026-108876: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...

PT-2026-110198

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the putCancelQuit handler of SysUserController. This issue allows any authenticated user to cancel user resignations. Low-privileged attackers can restore ended,...