EUVD-2026-96598
GHSA-x5p8-h4j8-4cch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any low-privileged user
-
ExploitCall listPackByTenantUserId with arbitrary tenantId/userId
-
ImpactEnumerate tenant packs and identify tenant administrators
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated account on the JeecgBoot instance (CVSS PR:L) and a deployment running in multi-tenant mode, since the attack enumerates other tenants' product-pack configurations via attacker-supplied tenantId and userId parameters to the listPackByTenantUserId endpoint. No user interaction and no special non-default feature toggle are needed beyond multi-tenancy being in use. Limiting factors: the attacker must first obtain or register any authenticated account, the impact is confined to read-only disclosure of tenant pack configuration and tenant-administrator identity (no data modification or service disruption), and single-tenant deployments have little to enumerate. |
| Impact | This is a medium-severity information-disclosure issue, not a critical priority. The vendor-supplied CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L with VI:N/VA:N) is internally consistent with the CWE-862 missing-authorization description: a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account, yielding limited confidentiality impact and no integrity or availability impact. Exploitation signals are mixed but modest: publicly available exploit code exists (POC by VulnCheck), which raises practical exploitability, but the CVE is NOT listed in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be confirmed from available data. The combination of 'PR:L + only VC:L' means the real-world value to an attacker is reconnaissance - enumerating tenant product-pack configurations and identifying which accounts are tenant administrators - rather than direct compromise. Treat this as a legitimate but second-tier fix: valuable as a chaining/targeting primitive against multi-tenant deployments, but on its own it is a high-confidence authorization bug with low direct impact, not a high-CVSS-but-low-risk false alarm nor an emergency. |
| Exploit ScenarioDerived | A low-privileged user with any valid account on a multi-tenant JeecgBoot instance sends a request to the SysTenantController listPackByTenantUserId handler supplying tenantId and userId values belonging to other tenants. Because the handler performs no authorization check (CWE-862), it returns product-pack configuration for arbitrary tenants and reveals which of their users hold tenant-administrator roles, giving the attacker a precise target list for follow-on attacks. A public proof-of-concept script (poc_tenant_pack_by_user.py) published via VulnCheck demonstrates the enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
An authenticated low-privileged user on JeecgBoot through 3.9.5 can query any tenant's product-pack configuration by calling the SysTenantController listPackByTenantUserId handler with attacker-chosen tenantId and userId parameters, because that handler performs no authorization check on the caller's ownership of the requested tenant. The result is read-only disclosure - tenant pack settings plus the identities of users who are tenant administrators - which is useful for reconnaissance and privilege-mapping but causes no data modification or service disruption (CVSS 5.3 / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Publicly available exploit code exists in a GitHub proof-of-concept repository, and exploitation is meaningful only in multi-tenant deployments where other tenants exist to enumerate; there is no confirmation of active exploitation (CISA KEV) at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, and the only upstream reference supplied is the vulnerable source range rather than a fix commit or tagged release, so remediation must currently rely on code-level correction and compensating controls. The most reliable fix is to modify SysTenantController's listPackByTenantUserId handler so it no longer trusts client-supplied identifiers: derive tenantId and userId from the authenticated security context (or validate that the requested tenant matches the caller's own tenant) and add a role or permission gate such as @PreAuthorize/@RequiresPermissions restricting the handler to tenant-administrator or platform-admin roles; note that this is a custom change that must be re-applied after each upstream upgrade until an official fix ships. As an interim control, block or rate-limit requests to the listPackByTenantUserId handler at the reverse proxy, gateway, or WAF for all roles that do not legitimately need it - the trade-off is that tenant pack information may stop rendering for some administrative screens, and path-based rules must be re-validated after any route change. Organizations not using multi-tenancy can disable multi-tenant mode entirely to remove the exposure, accepting that tenant-management features will be unavailable. Because exploitation requires only any authenticated account, tighten account provisioning and self-registration on internet-facing instances, and enable audit logging on SysTenantController calls so anomalous tenantId/userId enumeration patterns can be detected and the leaked tenant-administrator identities monitored for follow-on targeting. Track the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-listpackbytenantuserid) and the JeecgBoot repository for an official patched release before removing these compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code/rapid-development platform whose jeecg-system-biz module implements system services, including multi-tenant management in SysTenantController. The vulnerable code, referenced in the vendor repository at lines 1034-1047 of SysTenantController.java, exposes the listPackByTenantUserId handler without an authorization check, the classic CWE-862 (Missing Authorization) root cause: the method trusts client-supplied tenantId and userId values and returns tenant product-pack data for whatever identifiers are passed, rather than deriving the tenant from the authenticated security context or enforcing a role/permission gate (for example @PreAuthorize/@RequiresPermissions). Because the flaw is a missing check rather than a memory-safety or injection bug, it is reliably reachable over HTTP with a normal session token. The CPE entry cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is a wildcard over all JeecgBoot releases, consistent with the advisory scoping the issue to versions through 3.9.5. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree that the effect is limited to confidentiality, requires a pre-existing authenticated account, and needs no user interaction or special configuration beyond multi-tenancy being enabled.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network endpoint reachable by any authenticated low-privileged user (PR:L, AC:L), yielding only limited information disclosure (C:L) with no integrity or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB