EUVD-2026-97046
GHSA-px44-73hg-cqm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft PUT to /sys/user/batchEditUsers
-
ExploitSubmit arbitrary user and department IDs
-
ExecutionReassign departments and overwrite positions
-
ImpactSubvert org-scoped access controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level - the flaw is reachable by ordinary low-privileged users, not only admins, because the batchEditUsers handler performs no authorization check. No non-default configuration, feature toggle, or user interaction is needed; the vulnerable /sys/user/batchEditUsers endpoint is exposed in standard deployments through 3.9.5. The primary limiting factor is the authentication requirement (PR:L) - an attacker must first obtain or register an account - and the impact is confined to integrity of user department/position assignments, with no data disclosure or service disruption, which bounds realistic severity. |
| Impact | This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 are internally consistent with the description: remote, low-complexity, no user interaction, but requiring an authenticated low-privileged account (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality (VC:N) or availability (VA:N) consequence. A public proof-of-concept exists (an exploit script referenced on GitHub) and the finding was reported by VulnCheck, which raises practical exploitability for anyone who already holds a valid account. However, there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread opportunistic exploitation cannot be confirmed or quantified from available data. No SSVC decision framework data was supplied. The limiting factors - authentication required and integrity-only impact (manipulation of department/position assignments rather than code execution or data theft) - keep the real-world risk in the moderate band. The value of the flaw lies in trust/organizational manipulation (e.g., relocating administrator accounts between departments to subvert org-scoped access controls) rather than direct compromise. Prioritize patching in multi-tenant or large-org JeecgBoot deployments where department-based authorization is security-relevant; deprioritize relative to any unauthenticated RCE. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user sends a crafted PUT request to /sys/user/batchEditUsers supplying arbitrary user and department IDs. Because the handler lacks an authorization check (CWE-862), the request succeeds and reassigns targeted users - including administrators - to attacker-chosen departments and overwrites their positions. A public PoC script (poc_sys_user_batch_edit.py) automates this request, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated account - including the lowest-privileged user - to reassign users between departments and overwrite their positions by sending PUT requests to /sys/user/batchEditUsers with arbitrary user and department IDs. Because the SysUserController batchEditUsers handler performs no permission check, an attacker can move administrators into attacker-chosen departments and tamper with organizational metadata, but the assessed impact is integrity-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N; vendor-scored CVSS 4.0 5.3) with no data disclosure or service disruption. Publicly available exploit code exists in a public GitHub repository, though the issue is not confirmed actively exploited (CISA KEV), and the authentication prerequisite keeps overall risk moderate rather than emergency-grade.
RemediationAI
No vendor-released patch identified at time of analysis; the only upstream reference provided is a pointer to the vulnerable source code rather than a fixed release or commit, so administrators should track the vendor advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-batcheditusers and the JeecgBoot repository for a corrected version beyond 3.9.5. As a code-level compensating control, add an authorization annotation (for example @RequiresPermissions or @RequiresRoles) or an explicit permission check to the batchEditUsers method in SysUserController so that only users holding a user-management permission can invoke it; the trade-off is that legitimate low-privilege administrative workflows relying on that endpoint will begin returning authorization errors until role mappings are updated. If code changes are not feasible, block or restrict external access to PUT /sys/user/batchEditUsers at a reverse proxy or WAF, permitting it only for trusted administrative roles or source ranges - this breaks the bulk department-reassignment feature in the JeecgBoot admin UI for anyone outside the whitelist and can generate false positives if the path is matched too broadly. Additional hardening includes validating on the server side that the caller has authority over every target user and destination department ID in the request body, auditing accounts for unexpected department or position changes via application logs, and reviewing account-issuance policies since the flaw is exploitable by any authenticated user, meaning self-registration or guest accounts widen the exposure considerably.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in JeecgBoot, an open-source Java/Spring Boot low-code development platform that uses Apache Shiro for authentication and authorization. The affected handler, batchEditUsers in org.jeecg.modules.system.controller.SysUserController (referenced in the upstream source at lines 1955-1967 of commit e3b9dc0), accepts bulk user-to-department assignment data over HTTP PUT at /sys/user/batchEditUsers. In JeecgBoot, privileged controller methods are normally gated by Shiro annotations such as @RequiresPermissions or @RequiresRoles, or by equivalent permission checks; this handler omits that gate, so any successfully authenticated session passes straight through to the service layer, where user and department IDs from the request body are applied without validating that the caller has authority over the target users or the destination departments. The vulnerability class is an authorization/access-control gap rather than an injection or memory-safety bug, meaning exploitation depends solely on having a valid session, not on crafting malformed input. The CPE entry cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates the wildcard covers all JeecgBoot versions up to and including 3.9.5, and the flaw is reachable in default deployments with no special configuration, feature toggle, or user interaction required.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote endpoint reachable with any authenticated low-privileged account (PR:L), no user interaction, and only limited integrity impact from altering department/position data; no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and department ids to move users, including administrators, between departments and overwrite positions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB