EUVD-2026-97057
GHSA-cc33-2w5g-wpvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitPOST to editThirdAppConfig handler
-
ExecutionOverwrite DingTalk/WeCom/Feishu client credentials
-
ImpactRedirect directory sync and messaging to attacker app
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the JeecgBoot instance at any privilege level (CVSS PR:L) - no admin role is needed because the editThirdAppConfig handler in ThirdAppController.java omits the authorization check. Meaningful impact additionally requires that the target has a DingTalk, WeCom, or Feishu third-party integration configured, since the attack overwrites those integrations' client id/secret, agent id, and corp id. Limiting factors: the attacker must first obtain or hold any low-privilege account (self-registration or credential access), and environments not using third-party IM/directory integrations have little to steal or disrupt via this endpoint. |
| Impact | This is a real but context-dependent priority rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 (High) and is internally consistent with the description: network-reachable, low-complexity, and requiring low privileges (PR:L) - matching the 'any authenticated user' claim. Impact is correctly scoped to integrity only (VI:H, with VC:N/VA:N), reflecting unauthorized modification of third-party app configuration rather than data theft or outage. Publicly available exploit code exists (a VulnCheck-referenced Python POC), which raises practical risk, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - treat this as POC-available, not in-the-wild. The signals are consistent with no major conflicts: the one caveat is that real impact is gated on the target actually having DingTalk/WeCom/Feishu integrations configured, which is not captured by the CVSS score. EPSS and KEV data are both absent and should be checked before final prioritization. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or an attacker who has obtained any valid account) sends a crafted POST request to the editThirdAppConfig handler, which performs no role/authorization check. They overwrite the client id, client secret, agent id, and corp id for the organization's DingTalk/WeCom/Feishu integration, pointing directory synchronization and messaging at an attacker-controlled application - or simply break the integration. A public POC (poc_sys_thirdapp_edit_config_post.py) demonstrating this request already exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party integration settings - client id, client secret, agent id and corp id - through the unprotected editThirdAppConfig handler, redirecting directory synchronisation and messaging to attacker-controlled applications or breaking the integrations outright. The defect is a missing authorization check (CWE-862) in ThirdAppController.java with an assessed integrity impact (CVSS 3.1 base 7.1, PR:L, I:H), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is reported. Real-world impact is context-dependent: instances with no configured third-party IM/directory integration expose little to steal or disrupt through this endpoint.
RemediationAI
No vendor-released patch version is identified in the available intelligence; 3.9.5 is the latest version noted as affected, so no fixed release can be cited. Until an upgrade is confirmed, the most direct control is to add an authorization check to the /sys/thirdApp/editThirdAppConfig endpoint - require an administrator/privileged role using the platform's Shiro permission annotations - with the trade-off that legitimate admin configuration workflows will also be gated and must be updated accordingly. As an interim compensating control, restrict POST access to that path at the reverse proxy or WAF to trusted administrator networks, accepting the operational burden of re-routing management traffic. If DingTalk, WeCom or Feishu integrations are not in use, delete the stored third-party configuration so the endpoint has nothing to overwrite; if they are in use, rotate the client secrets, corp id and agent id, verify integration state on a schedule, and alert on unexpected configuration changes. Monitor upstream JeecgBoot releases for an official fix and apply it once published, and consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-thirdapp-editthirdappconfig) and the upstream source reference (https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdAppController.java#L412-L438) for updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform widely deployed in Chinese enterprise environments, and it relies on Apache Shiro for access control. The vulnerable handler editThirdAppConfig in jeecg-module-system/jeecg-system-biz/.../ThirdAppController.java (lines 412-438) persists third-party application configuration without any permission or role check, which maps to CWE-862 (Missing Authorization): the endpoint enforces authentication but not authorization, so any valid session can invoke it. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* denotes all releases up to and including 3.9.5. Because the stored client secret, corp id and agent id underpin OAuth trust with DingTalk, WeCom and Feishu, overwriting them lets a low-privileged attacker hijack or break the tenant's directory synchronisation and message delivery - the assessed vector reflects high integrity impact (I:H) with no assessed confidentiality or availability effect.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint needing only a low-privilege authenticated account (PR:L, AC:L); impact is unauthorized config modification (I:H) with no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or Feishu integrations to redirect directory synchronisation and messaging to attacker-controlled applications or break them.
Technical POC Analysis
CWE-862 (Missing Authorization) in ThirdAppController.editThirdAppConfig, mapped to POST|PUT /sys/thirdApp/editThirdAppConfig (ThirdAppController.java:412-438) in JeecgBoot through 3.9.5.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JeecgBoot versions through 3.9.5 contain a missing authorization check in the ThirdAppController handler that allows authenticated users to modify third-party integration settings for DingTalk, WeCom, and Feishu. This could enable attackers to redirect directory synchronization and messaging to attacker-controlled applications, disrupting business communications or exposing sensitive organizational data. Leadership should prioritize remediation because publicly available exploit code exists and the vulnerability affects the integrity of critical enterprise integrations.
No vendor-released patch identified at time of analysis. Interim mitigations include network-level restrictions on the vulnerable endpoint, monitoring for unauthorized configuration changes, rotating integration secrets, and disabling unused third-party integrations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB