EUVD-2026-96596
GHSA-gp9m-m3c8-jw96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit tenant-admin application via doApplyTenantPackUser
-
ExploitSelf-approve via PUT /sys/tenant/passApply
-
ExecutionGain tenant administrator pack permissions
-
ImpactControl arbitrary tenant
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the JeecgBoot instance (PR:L) - the attacker must be able to call doApplyTenantPackUser to create a pending application and then PUT /sys/tenant/passApply to approve it. The deployment must use JeecgBoot's multi-tenant ('tenant pack') functionality for the privilege gain to be meaningful. No user interaction, no special non-default feature toggle, and no elevated privileges are cited in the description; the limiting factors are that the attacker needs an existing low-privilege account and that the target must operate tenants. Affected: JeecgBoot through 3.9.5. |
| Impact | This is a genuine priority for any organization running JeecgBoot in a multi-tenant configuration, though the signals are moderate rather than critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low-privilege authentication (PR:L) - meaning any registered/authenticated user, not an anonymous attacker. Technical impact is high on confidentiality and integrity (VC:H/VI:H) but none on availability (VA:N), consistent with a privilege-escalation/broken-access-control flaw (CWE-862) rather than a service-disrupting bug. A public POC exists (reported by VulnCheck), which materially raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists,' which must not be conflated with in-the-wild activity. Net: a real, exploitable privilege-escalation issue with a working POC that any authenticated tenant user can run, but absent KEV/EPSS data the urgency is driven by the public exploit and the authenticated-but-low bar rather than by confirmed mass exploitation. |
| Exploit ScenarioDerived | An attacker who holds any ordinary authenticated account on a JeecgBoot instance first files a pending tenant-admin application via the doApplyTenantPackUser endpoint, then self-approves it by issuing a PUT request to /sys/tenant/passApply, which fails to verify the caller's authorization. The result is that the low-privileged user grants themselves tenant administrator ('pack') permissions in an arbitrary tenant. A public POC (poc_tenant_ownership_and_pack_approval.py) demonstrating this chain is available, and given the low attack complexity (AC:L) the attack is straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrator application and obtain tenant-admin ('tenant pack') permissions across any tenant. The SysTenantController passApply handler performs no authorization check, so a low-privilege account can file an application via doApplyTenantPackUser and then approve it with a PUT to /sys/tenant/passApply, reaching high confidentiality and integrity impact without user interaction or elevated privileges (assessed CVSS 3.1 8.1, PR:L). Publicly available exploit code exists - a Python proof-of-concept for tenant ownership and pack approval is published on GitHub and referenced by VulnCheck - but no CISA KEV entry has been reported, so confirmed active exploitation cannot be asserted.
RemediationAI
No vendor-released patch version was identified at time of analysis: the only vendor-supplied reference in the input points to the vulnerable source lines in SysTenantController.java (commit e3b9dc0a, lines 838-842) rather than to a tagged fixed release, so organizations should treat any upgrade as unconfirmed until JeecgBoot publishes a version above 3.9.5 and should track the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-passapply) for a fixed build. Until then, apply compensating controls in order of effectiveness: add a server-side authorization check (or an API-gateway/reverse-proxy rule) that rejects PUT /sys/tenant/passApply and calls to doApplyTenantPackUser from any principal lacking an explicit platform- or tenant-administrator role - this directly blocks the exploit chain, but must be maintained outside the application and will break legitimate self-service application flows if scoped too broadly; if multi-tenancy is not required, disable the tenant pack feature entirely so the affected endpoints are unreachable, accepting loss of tenant isolation functionality; restrict the /sys/tenant/* namespace to trusted administrative networks or IP ranges, which reduces exposure but does not remediate the underlying flaw for insiders; and audit the sys tenant pack user and tenant application tables for approved records whose applicant and approver are the same account, plus alert on the doApplyTenantPackUser-then-passApply sequence in logs, as detection rather than prevention. Note that the public GitHub PoC lowers the effort required to exploit this, so prioritization should assume a capable authenticated attacker already inside the tenant.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot based low-code development platform whose system module includes a multi-tenant subsystem, often described as 'tenant packs', implemented in jeecg-system-biz under org.jeecg.modules.system.controller.SysTenantController. The vulnerability is CWE-862 (Missing Authorization): the passApply handler that finalizes a tenant administrator application does not verify that the caller is a tenant administrator, a platform administrator, or the owner/reviewer of the application being approved. The affected flow is two-step and entirely reachable over HTTP with a normal session - an attacker first creates a pending request through doApplyTenantPackUser and then submits an approval through PUT /sys/tenant/passApply, which flips the application to approved and grants the caller tenant administrator pack permissions. The publicly linked source lines (SysTenantController.java, lines 838-842, commit e3b9dc0a) show the handler in question. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is a wildcard-version entry, confirming the affected product with no version ceiling expressed in the CPE itself. Because the flaw is authorization logic rather than memory corruption or injection, exploitation is deterministic and requires no crafted payload; the only prerequisites are a valid low-privilege authenticated session and a deployment that actually uses JeecgBoot's multi-tenant/tenant pack functionality.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable with low complexity, but requires an authenticated low-privilege account (PR:L) to invoke the apply/approve endpoints; high C/I from tenant-admin takeover, no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
Technical POC Analysis
CWE-862 (Missing Authorization) in the tenant-pack approval handler.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JeecgBoot versions through 3.9.5 contain a high-severity privilege escalation flaw that allows an authenticated low-privilege user to self-approve a tenant administrator application and gain tenant-wide administrative rights. Publicly available exploit code exists, so any organization using affected JeecgBoot deployments with multiple tenants or untrusted authenticated users faces elevated risk of unauthorized access to tenant data and administrative functions. Security leadership should prioritize immediate containment, detection, and remediation planning across all affected instances.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to /sys/tenant/passApply and tenant administration endpoints, blocking or disabling doApplyTenantPackUser/passApply functionality via reverse proxy or WAF where business-feasible, enforcing least privilege and strong authentication for all JeecgBoot accounts, monitoring and auditing tenant pack approval events for unauthorized self-approvals, and manual review of tenant administrator assignments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB