Is there a public PoC exploit available for CVE-2025-14908?

Yes, a public proof-of-concept exploit is available for CVE-2025-14908. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2025-14908?

Yes, a patch is available for CVE-2025-14908. Update the affected software to the latest version immediately.

JeecgBoot CVE-2025-14908

Q: What is the CVSS score of CVE-2025-14908?

CVE-2025-14908 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

LOW

Improper Authentication (CWE-287)

2025-12-19 cna@vuldb.com

Java Authentication Bypass Jeecg Boot

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:38 vuln.today

DescriptionCVE.org

A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Multi-Tenant Management Module. Performing manipulation of the argument ID results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee. It is recommended to apply a patch to fix this issue.

AnalysisAI

Authentication bypass in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate tenant ID arguments in the SysTenantController, resulting in improper authentication checks that grant unauthorized access to other tenants' data. The vulnerability has a low CVSS score of 2.1 but publicly available exploit code exists, suggesting active researcher interest despite minimal real-world impact signals (EPSS 0.32%, low severity scope). Exploitation requires prior authentication and produces only limited information disclosure within the multi-tenant architecture.

Technical ContextAI

JeecgBoot is a Java-based low-code application development platform built on Spring Boot that includes multi-tenant support for managing isolated customer environments. The vulnerability resides in the SysTenantController component of the Multi-Tenant Management Module, specifically in how it validates the tenant ID parameter passed in HTTP requests. The root cause (CWE-287: Improper Authentication) stems from insufficient validation of the ID argument before processing tenant-specific operations, allowing authenticated users to bypass tenant isolation by manipulating the ID value to reference tenants they should not have access to. This is a horizontal privilege escalation within the multi-tenant context where one tenant customer can access another tenant's data.

RemediationAI

Apply vendor patch immediately by updating to a JeecgBoot release that includes commit e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2 or later (patch version not explicitly named in available data; verify with vendor release notes). The patch addresses tenant ID validation in SysTenantController by implementing proper authorization checks to ensure users can only access tenants they are assigned to. If immediate patching is not possible, implement network-level or application-level access controls that restrict SysTenantController endpoints to authorized administrative users only, reducing the attack surface to legitimate tenant administrators (note: this reduces multi-tenant flexibility but preserves data isolation). Monitor authentication logs for repeated requests with varying tenant ID parameters from the same user account, which would indicate exploitation attempts.