EUVD-2026-96576
GHSA-26w9-3rx3-xg95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryCraft DELETE /sys/user/deleteUserGroupBatch request
-
ExploitSupply arbitrary groupId and userIds
-
ExecutionBypass missing authorization check
-
ImpactDelete sys_ugroup_user membership rows
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the JeecgBoot application at any low-privilege level (PR:L) - the attacker must be able to reach the authenticated REST API. No user interaction, special configuration, or administrative role is needed: the DELETE /sys/user/deleteUserGroupBatch endpoint accepts attacker-controlled groupId and comma-separated userIds and performs no permission or tenant-isolation check before deleting sys_ugroup_user rows. Limiting factors: exploitation is impossible for fully unauthenticated attackers (credentials or a self-registerable account are required), and impact is restricted to tampering with user-group membership (integrity), not data disclosure or service disruption. Multi-tenant deployments are particularly exposed because tenant checks are absent. |
| Impact | This is a genuine but low-severity, authorization-only flaw - not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score align with the description: a network-reachable endpoint reachable by any low-privileged authenticated user, with low attack complexity and no user interaction. Impact is confined to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) impact - the attacker can tamper with group membership data but cannot read data or take the system down. A public POC exists (VulnCheck, github-poc), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent: moderate CVSS, POC available, no KEV, limited (integrity-only) technical impact. The key limiting factor is PR:L - this requires valid authenticated credentials, so it is a post-authentication privilege/authorization issue (an insider or a compromised low-privilege account), not a pre-auth remote takeover. Net: a real defect worth patching, especially in multi-tenant deployments, but not an emergency relative to critical RCE-class issues. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user (or an attacker who has phished or registered a standard account) sends a crafted DELETE request to /sys/user/deleteUserGroupBatch supplying an arbitrary groupId and a comma-separated list of userIds. Because the endpoint performs no permission or tenant check, the server deletes the targeted sys_ugroup_user rows, removing members from administrator-maintained groups. A public POC (VulnCheck/AnkesKasty) automates this request, lowering the bar to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any low-privileged authenticated user silently remove members from administrator-maintained user groups by calling DELETE /sys/user/deleteUserGroupBatch with an arbitrary groupId and a comma-separated list of userIds. The endpoint performs no permission or tenant-isolation check before deleting rows from sys_ugroup_user, so the impact is limited to integrity tampering with group membership rather than data disclosure or denial of service; publicly available exploit code exists (a PoC script is published), and no confirmed vendor patch was identified at time of analysis. Successful exploitation requires a valid authenticated session at any privilege level (PR:L in both the reported CVSS 4.0 vector and our assessed CVSS 3.1 vector), meaning fully unauthenticated attackers cannot exploit it, and no CISA KEV listing or confirmed active exploitation is associated with this issue.
RemediationAI
No vendor-released patch was identified in the available data at the time of analysis, so remediation must begin with compensating controls while a fixed JeecgBoot release is awaited. The most direct mitigation is to block or gate DELETE requests to /sys/user/deleteUserGroupBatch at the reverse proxy, API gateway, or WAF layer; the trade-off is that legitimate user-group management in the admin UI will stop working and must be performed through an alternative, access-controlled channel. As a code-level fix, add an explicit authorization annotation (for example @PreAuthorize with the appropriate permission code) plus a tenant-scope filter on the SysUserController handler before the delete is executed, and rebuild/redeploy the affected jeecg-system-biz module; this requires validating that existing administrator roles carry the newly enforced permission, otherwise group management will break for legitimate admins as well. Because exploitation requires only a valid low-privilege authenticated session, reduce the attack surface by disabling self-registration and by reviewing accounts for unnecessary API access (side effect: onboarding friction and potential disruption for legitimate external users). Finally, enable and monitor audit logging on group-membership changes, alerting on sys_ugroup_user deletions and on any request where the supplied groupId does not belong to the caller's tenant, so that tampering is detected even if prevention fails. Consult the referenced advisories - https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-deleteusergroupbatch-endpoint and the vulnerable code at https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L851-L866 - for updates, and note that the published PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal_batch.py can be used to verify whether your instance is exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose system module (jeecg-system-biz) exposes REST controllers for user and group administration. CVE-2026-108637 is a classic CWE-862 Missing Authorization defect: the handler for DELETE /sys/user/deleteUserGroupBatch, implemented in SysUserController.java (referenced lines 851-866 at the cited upstream commit), accepts attacker-controlled groupId and comma-separated userIds and deletes the corresponding rows from the sys_ugroup_user join table without evaluating the caller's role permissions and without applying the platform's multi-tenant data-isolation filter. The root cause class (CWE-862) is distinct from injection or memory-safety issues: the code simply lacks an authorization and tenant-scope check on a state-changing operation, so the URL itself becomes an unguarded privileged action for any authenticated session. The CPE string cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* identifies the JeecgBoot application package across all versions covered by the advisory, i.e. through 3.9.5, confirming this is a product-level rather than version-pinned CPE. Multi-tenant deployments are the most exposed configuration because tenant checks are absent from this endpoint, allowing cross-tenant group modification within the same installation.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable authenticated endpoint with low complexity needs a valid low-privilege account (PR:L); only group-membership data is tampered, so I:L and C:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB