CVE-2026-108876

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the putCancelQuit handler of SysUserController. This flaw allows any authenticated user to cancel user resignations. By supplying specific user ids and a tenantId parameter (or X-Tenant-Id header), a l...

EUVD-2026-97050

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,...