JeecgBoot CVE-2026-108638

Requires a valid authenticated JeecgBoot account of any privilege level (PR:L) with network access to the application's SysUserController API; no special product feature or non-default configuration is needed because the deleteGroupUser handler simply omits ownership and tenant authorization checks. The attacker must know or enumerate a valid groupId and userId. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, impact is confined to removing group memberships (an integrity/authorization-state change) rather than data theft or code execution, and risk is materially higher in multi-tenant deployments where low-privileged accounts coexist with administrator-maintained groups.

This is a genuine but modest-severity issue best characterized as a broken-access-control / missing-authorization flaw (CWE-862), not a critical RCE. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), and impact is limited to integrity of authorization data (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect, yielding a MEDIUM 5.3. Publicly available POC code (VulnCheck/GitHub) raises practical risk and lowers the skill barrier, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the publicly available exploit code exists but is a distinct signal from in-the-wild use. Net: a real priority for multi-tenant JeecgBoot deployments where low-privileged accounts are plentiful (the missing tenant/ownership check lets any user tamper with any group), but a lower priority for single-tenant or tightly-controlled instances. No key signals conflict with the description; the main missing data is EPSS probability and any vendor-confirmed fixed version.

A low-privileged but authenticated JeecgBoot user (e.g., a basic tenant account) sends a crafted DELETE request to the deleteGroupUser endpoint in SysUserController supplying an arbitrary groupId and userId. Because the handler performs no ownership or tenant authorization check, the request removes the targeted victim from an administrator-maintained group, disrupting their role/permission assignments. A public POC (poc_user_group_member_removal.py) automates this, so exploitation requires only valid low-level credentials and network access to the web UI/API.