EUVD-2026-96560
GHSA-8cfj-f246-mwh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any low-privileged user
-
ExploitEnumerate position ids via unguarded list endpoint
-
ExecutionSend crafted PUT/POST to /sys/position/edit
-
ImpactAlter organizational position names, codes, and ranks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session for any low-privileged JeecgBoot account (PR:L) - it is not reachable by fully unauthenticated attackers. Given such an account, the concrete preconditions are: (1) the SysPositionController edit handler at /sys/position/edit lacks an authorization check, and (2) the position list endpoint is unguarded, letting the attacker enumerate valid position ids to supply in the PUT/POST request. Limiting factors that bound real-world risk: a credentialed account is needed, no user interaction is required, and impact is confined to the integrity of organizational position data (names, codes, ranks) with no confidentiality or availability impact and no escalation to system compromise. |
| Impact | This is a genuine but moderate-severity issue, correctly rated medium (CVSS 5.3). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is internally consistent with the description: network-reachable with low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability loss. Publicly available exploit code exists (a Python POC on GitHub) and the finding was reported by VulnCheck, which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation - POC availability must not be conflated with in-the-wild use. The realistic risk is a logged-in user tampering with organizational position records (names, codes, ranks), i.e. a broken-access-control / data-integrity problem rather than a path to code execution or data theft. Bottom line: a real but bounded priority - patch in routine cycles and add the missing authorization check, but it does not warrant emergency handling given the authentication requirement and integrity-only impact. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user queries the unguarded position list endpoint to harvest valid position ids, then issues a PUT or POST request to /sys/position/edit to rename or re-rank organizational positions they should not control. A public Python proof-of-concept (poc_c090_position_edit.py) demonstrates the request, and because the CVSS vector is AV:N/AC:L, it works remotely over the network with low complexity once a session token is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in the JeecgBoot SysPositionController edit handler (/sys/position/edit) lets any authenticated low-privileged account rewrite organizational position names, codes, and ranks via crafted PUT or POST requests, affecting JeecgBoot through 3.9.5. Because the position list endpoint is also unguarded, an attacker can first enumerate valid position IDs and then target them directly, so no guesswork or elevated role is required. Impact is confined to the integrity of position reference data - there is no confidentiality or availability loss and no escalation to system compromise - and the issue is correctly rated medium (CVSS 5.3); publicly available exploit code exists, while no CISA KEV active-exploitation entry is indicated.
RemediationAI
No vendor-released fix version for CVE-2026-108621 is identified in the available data, so JeecgBoot 3.9.5 and earlier should be treated as unpatched until the vendor publishes an advisory; administrators should track the JeecgBoot repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-position-edit) for a patched release and upgrade immediately once one is available. Until then, the primary compensating control is to add the missing server-side authorization check on the edit handler - annotate the SysPositionController edit method with the platform's position-management permission (for example @RequiresPermissions("system:position:edit")) and apply an equivalent guard to the position list endpoint so IDs can no longer be enumerated; this is a code change that must be maintained across upgrades and re-applied if the file is overwritten. Where code changes are not feasible, block /sys/position/edit and /sys/position/list at the reverse proxy or WAF for all roles except a tightly allow-listed administrative group, accepting that this breaks legitimate position administration for any non-allow-listed operator and requires URL-encoding and case-variant normalization to avoid trivial bypass. Secondary measures include granting low-privileged accounts only the roles they genuinely need so that no unnecessary authenticated session can reach the endpoint, and enabling audit logging or alerting on position create/update events so that unauthorized name, code, or rank changes are detected quickly - monitoring alone does not prevent the modification, it only shortens the window before discovery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose backend module jeecg-system-biz exposes administrative REST controllers secured by method-level authorization checks. CVE-2026-108621 is a CWE-862 Missing Authorization defect: the SysPositionController edit handler (referenced at lines 137-152 of SysPositionController.java in the vendor repository) performs the position update without verifying that the caller holds the position-management permission. Compounding this, the corresponding position list endpoint is equally unguarded, so the class of objects being manipulated can be enumerated rather than guessed - the missing check on the write path and the missing check on the read path together convert a permission gap into a practical, repeatable integrity attack. The CVSS 4.0 vector confirms network reachability with low attack complexity and no user interaction, but specifies PR:L (a valid session is required) and limits impact to low integrity loss with no confidentiality or availability effect (VC:N/VI:L/VA:N), which matches our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The referenced CPE, cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*, is version-wildcarded, so treat all releases through 3.9.5 as in scope rather than assuming only a single build is affected.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote low-complexity request needs a low-privileged authenticated account (PR:L); impact is limited unauthorized modification of position records, so I:L with C:N and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit to alter position names, codes, and ranks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB