2 matches found
EUVD-2026-96576
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...
5.3CVSS5.8AI score0.00238EPSS
SaveExploits0References4
CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...
5.3CVSS5.9AI score
SaveExploits0References6
20