EUVD-2026-96559
GHSA-gq82-22fr-9c7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate position IDs via unguarded list endpoint
-
ExploitSubmit comma-separated IDs to deleteBatch
-
ExecutionMissing authorization check bypassed
-
ImpactMass-delete sys_position rows and orphan assignments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the JeecgBoot instance (PR:L), but only low privileges - any logged-in user suffices, including non-administrative roles. The specific prerequisite is reachability of the SysPositionController deleteBatch handler and the companion position list endpoint, which lacks an authorization guard, allowing attackers to obtain valid position IDs. No special non-default configuration, user interaction, or platform-specific condition is needed. The primary limiting factor is the authentication requirement: unauthenticated internet attackers cannot exploit this, so risk concentrates in deployments with many or untrusted low-privilege users. |
| Impact | This is a genuine but moderate-severity issue, best characterized as a low-privilege data-destruction flaw rather than a critical breach. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, with no confidentiality impact (VC:N) and limited integrity/availability impact (VI:L/VA:L) - consistent with CWE-862 missing authorization. The base score of 5.3 (MEDIUM) aligns with the signals: the required authentication (PR:L) meaningfully caps blast radius and excludes anonymous internet exploitation. A public POC exists (reported by VulnCheck), which raises operational urgency, but no CISA KEV listing and no EPSS score were provided, so there is no evidence of widespread automated exploitation at this time. The main tension is between a working public exploit (lowers skill barrier) and the authentication prerequisite plus medium severity (limits who and what can be hit). For organizations running JeecgBoot with untrusted or numerous low-privileged users, this is a real patch-worthy priority because it enables destructive, hard-to-reverse mass deletion; for isolated internal deployments it is lower urgency. No EPSS or KEV data was supplied - exploitation likelihood is inferred only from POC availability. |
| Exploit ScenarioDerived | A low-privileged authenticated user queries the unguarded position list endpoint to enumerate valid sys_position IDs, then submits them as a comma-separated list to the SysPositionController deleteBatch handler, which performs no authorization check. The attacker deletes all organizational positions in a single request, orphaning user-position assignments and disrupting role/organization structure. A public POC script (poc_console_delete_routes.py) demonstrating this is already available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Any authenticated user, including low-privileged accounts, can delete organizational positions in JeecgBoot 3.9.5 and earlier by exploiting a missing authorization check in the SysPositionController deleteBatch handler. Attackers harvest valid position IDs from an unguarded list endpoint and submit them as a comma-separated list, destroying sys_position records and orphaning user-position assignments. This is a moderate-severity data-destruction issue, reflected by the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; publicly available exploit code exists, but no active exploitation is confirmed in CISA KEV.
RemediationAI
No vendor-released patch version is referenced in the available intelligence; the supplied references point to the vulnerable source code and a VulnCheck advisory rather than a fixed release. The most direct fix is to apply an authorization check to the SysPositionController deleteBatch handler and the position list endpoint, for example requiring an administrative permission such as sys:position:delete, and then deploy the patched code once the vendor publishes it. Until then, compensating controls can reduce exposure: restrict network access to the deleteBatch and list endpoints at the reverse proxy or WAF so that only trusted administrative roles can reach them (trade-off: this may break legitimate position-management workflows for non-admin operators); disable the position-management feature entirely if the organization does not use it; monitor and alert on bulk DELETE requests to the SysPositionController handler; and reduce the number of untrusted low-privilege accounts on the JeecgBoot instance. Ensure sys_position and user-position mapping tables are backed up so data can be restored after deletion. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-position-deletebatch) for updates. Note that POC exploit code is publicly available at the GitHub repository AnkesKasty/cve-request-poc, so defenders should treat exploitation as straightforward for any authenticated user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a low-code development platform; the affected component is the system module's SysPositionController within jeecg-system-biz. The root cause is CWE-862 (Missing Authorization): the deleteBatch handler at lines 183-193 of SysPositionController.java lacks any permission check (such as Spring Security's @RequiresPermissions), so the only gate is authentication. The companion position list endpoint is similarly unguarded, giving attackers the IDs needed to invoke the delete operation. The vulnerable code is referenced in commit e3b9dc0aefe1943d9772b026f64ed671a7c82802, and a public PoC script (poc_console_delete_routes.py) demonstrates the request flow. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* uses a wildcard version, but the description bounds affected releases to through 3.9.5. The provided CVSS 4.0 vector includes PR:L and low integrity/availability impacts (VI:L, VA:L), matching the independent assessment that only low privileges are needed and that confidentiality is not impacted.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable with low complexity and only low-privilege authentication (PR:L); no data disclosure (C:N) but record deletion yields limited integrity and availability impact (I:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all sys_position rows and orphan user-position assignments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB