JeecgBoot CVE-2026-108882

Requires a valid authenticated low-privileged account on the target JeecgBoot instance (PR:L) - exploitation is not possible pre-authentication. Given such an account, the attacker simply issues a DELETE request to the SysPositionController removeUserPosition endpoint with arbitrary userIds and positionId values; no special product configuration, feature flag, or non-default deployment mode is needed, and no user interaction is required (UI:N). Limiting factors: the attacker must first obtain or register an account, so exposure is highest where self-registration is enabled or many low-trust accounts exist; impact is confined to deletion of user-to-position associations (integrity/availability of that mapping) with no confidentiality disclosure and no code execution; and deletions occur without logging, which hinders detection but does not expand the technical impact.

This is a genuine-but-moderate priority, not a critical emergency. The CVSS 4.0 base score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L - network-reachable, low attack complexity, but requires a low-privileged authenticated account (PR:L) and causes only limited integrity and availability impact to the sys_user_position association data, with no confidentiality loss. The flaw is CWE-862 (missing authorization): an already-authenticated user can act beyond their intended scope. Public exploit code exists (POC=YES, VulnCheck advisory plus a GitHub PoC script), which raises operational likelihood, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are therefore consistent rather than conflicting: a real, easy-to-automate access-control bug with a working PoC, but bounded blast radius (data-detachment, no RCE, no data theft) and an authentication precondition that limits exposure to users who already have an account. No EPSS value was supplied, so exploitation probability cannot be quantified from the input. Priority should be elevated for multi-tenant or externally-registrable JeecgBoot deployments where low-privilege accounts are easy to obtain, and lower for internal-only instances.

An attacker who holds any valid low-privileged JeecgBoot account (or self-registers one where registration is open) sends a crafted DELETE request to the removeUserPosition handler supplying arbitrary userIds and a positionId they do not own. Because the handler performs no authorization check, it deletes the targeted sys_user_position rows, silently detaching other users from their organizational positions without generating a log entry. A public PoC script and the VulnCheck advisory demonstrate the request, lowering the skill barrier to exploitation.