JeecgBoot CVE-2026-108656

Requires a valid authenticated low-privileged JeecgBoot account (PR:L) and a deployment using the multi-tenant feature where tenant-admin package applications exist; the attacker then increments the tenantId parameter on GET /sys/tenant/getTenantPackApplyUsers, which performs no tenant-ownership check. Exploitation is limited by the authentication requirement (no anonymous access) and by the presence of pending applicants to leak; impact is confined to read-only disclosure of applicant PII (usernames, real names, phone numbers, departments) with no write or availability effect.

This is a medium-severity information-disclosure issue, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and shows only confidentiality impact (VC:L, VI:N, VA:N) with no scope change - consistent with CWE-862 missing authorization that leaks PII but cannot alter data or affect availability. The attack is network-reachable with low complexity and no user interaction, but PR:L means a valid (if low-privileged) account on the target instance is required, which meaningfully narrows the threat to insiders or attackers who have already obtained any foothold credential. Publicly available exploit code exists (a GitHub PoC and a VulnCheck advisory), which raises practical likelihood, but there is no CISA KEV listing, so this is 'publicly available exploit code exists,' NOT confirmed active exploitation - do not conflate the two. EPSS and SSVC decision data were not provided in the input, so exploitation-probability and automatability signals cannot be weighed; this is a gap, not evidence of low risk. Net: a real but bounded cross-tenant PII leak worth patching promptly in multi-tenant deployments, below the urgency of an unauthenticated RCE.

A low-privileged user (or an attacker who has phished/obtained any valid JeecgBoot account) calls GET /sys/tenant/getTenantPackApplyUsers and iterates the tenantId parameter across tenants. Because the endpoint does not check tenant ownership, each request returns pending tenant-admin applicants' usernames, real names, phone numbers, and departments, enabling bulk harvesting of PII for social engineering or further targeting. A public PoC (poc_tenant_ownership_and_pack_approval.py) demonstrates the technique.