EUVD-2026-96599
GHSA-h7w9-2w78-xg7q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitSend PUT /sys/tenant/updateApplyStatus with arbitrary tenant id
-
ExecutionServer skips authorization check
-
ImpactOverwrite target tenant applyStatus across tenants
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold a valid authenticated JeecgBoot account with low privileges (PR:L) - self-registration or any ordinary tenant user suffices; no admin role is required. The vulnerable endpoint PUT /sys/tenant/updateApplyStatus performs no ownership/authorization check on the supplied tenant id, so exploitation needs no special configuration or non-default feature - it works against standard deployments reachable over the network. The only real limiting factor is the authentication requirement; there is no user interaction, and impact is confined to toggling other tenants' applyStatus (tenant administrator application enable/disable), not full tenant takeover. |
| Impact | This is a moderate-severity broken access control issue (CWE-862) whose signals are internally consistent but point to limited blast radius. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) and score of 5.3 indicate a network-reachable, low-complexity attack that requires an authenticated low-privileged account and yields only a low integrity impact (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect - matching the description, where the only consequence is overwriting the tenant applyStatus field. A public exploit (python PoC) and a VulnCheck advisory corroborate that the flaw is real and trivially reproducible, which raises practical likelihood of opportunistic abuse by any user who already holds credentials. However, this is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active, in-the-wild exploitation; the PR:L requirement and integrity-only impact keep it well below critical-priority. Net: a credible, easy-to-exploit multi-tenant integrity/authorization bug worth patching on normal cycles, but not an emergency - the headline risk is tenant-boundary violation by insiders or compromised low-privilege accounts, not unauthenticated mass exploitation. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (e.g. a normal tenant member or a self-registered account) sends a crafted PUT request to /sys/tenant/updateApplyStatus specifying a tenant id they do not own, flipping that tenant's applyStatus to enable or disable administrator applications. A public Python PoC exists, and because attack complexity is low and no user interaction is needed, the request succeeds against any reachable instance once the attacker has valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot (all versions through 3.9.5) lets any authenticated, low-privileged user alter tenant administrator application status for arbitrary tenants by sending a PUT request to /sys/tenant/updateApplyStatus with a tenant id they do not own. The endpoint performs no ownership or role check on the supplied identifier, so an ordinary account - including one obtained through self-registration - can toggle the applyStatus field and thereby enable or disable tenant-admin applications across the entire instance. Publicly available exploit code exists (a Python PoC is published in a public GitHub repository), though this is not confirmed as actively exploited in the wild; EPSS and KEV data were not provided, and the independent assessment rates this as a moderate-severity broken access control issue with limited blast radius, since impact is confined to status toggling rather than full tenant takeover.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so remediation must currently rely on compensating controls rather than an upgrade target - do not assume any version number for a fix, and monitor the JeecgBoot project and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-updateapplystatus) for an official release. The most direct control is to block or restrict PUT /sys/tenant/updateApplyStatus at the reverse proxy, API gateway, or WAF so that only trusted administrative roles and source ranges can reach it; the trade-off is that legitimate tenant-approval workflows driven from ordinary UI sessions will break unless the exception list mirrors the intended admin population. If the endpoint must stay broadly reachable, add a server-side authorization check in SysTenantController that validates the caller's role and tenant ownership before applying the applyStatus update - either as a local code patch or via a wrapper/filter enforcing tenant-scoped access - and audit tenant records for unexpected applyStatus changes, since toggling can silently enable or disable tenant administrator applications. Additional hardening with low disruption: disable self-registration so low-privileged accounts cannot be created at will, and alert on updateApplyStatus calls where the target tenant id differs from the caller's own tenant. These mitigations reduce exposure but do not remove the underlying missing-authorization flaw, so applying the vendor fix remains the durable solution once it exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-862 Missing Authorization defect in JeecgBoot's multi-tenant administration module. JeecgBoot is a low-code Java/Spring Boot platform whose system module exposes REST controllers (here SysTenantController, lines 799-808 in the upstream repository) that back tenant lifecycle operations, including review of tenant administrator applications via an applyStatus field. In a correctly designed multi-tenant controller, any request that mutates a tenant-scoped resource must verify both the caller's role and their ownership of, or administrative authority over, the target tenant id. That check is absent on the updateApplyStatus handler: the tenant id arrives as a client-controlled parameter and is used directly to locate and update the record, so authorization degenerates into simple authentication. The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) agree the flaw is network-reachable, requires only low privileges, needs no user interaction or non-default configuration, has no confidentiality or availability impact, and yields limited integrity impact - because the writable surface is the applyStatus flag rather than arbitrary tenant record contents. The CPE entry (cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*) confirms the advisory scope is unspecified/whole-product rather than a narrowly bounded version range.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint reachable by any authenticated low-privileged user (PR:L, AV:N, AC:L); only cross-tenant integrity of applyStatus is affected, so I:L and C:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB