EUVD-2026-96601
GHSA-3c84-rhq7-752f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged tenant user
-
ExploitCraft PUT /sys/tenant/deleteTenantPackUser
-
ExecutionSupply arbitrary userId and packId
-
ImpactRevoke victim's tenant-pack permissions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated low-privileged user account on a JeecgBoot instance (PR:L) that is operating in multi-tenant mode with tenant product packs configured, since the affected endpoint PUT /sys/tenant/deleteTenantPackUser manages tenant-pack user assignments. The core flaw is that this endpoint performs no authorization check on the supplied userId/packId, so any logged-in user can act on arbitrary tenants/users. Limiting factors that reduce real-world risk: exploitation is impossible without first obtaining authenticated access, the deployment must actually use the multi-tenancy/tenant-pack feature, and impact is confined to revoking permission assignments (no confidentiality exposure and no code execution). |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L confirms an authenticated low-privileged account is required - this is a broken-access-control/authorization flaw (CWE-862), not pre-auth RCE. Impact is deliberately narrow: VC:N (no confidentiality loss), with only VI:L and VA:L reflecting the ability to revoke other users' tenant-pack permissions (including tenant administrator access), i.e. a privilege/availability disruption rather than code execution or data theft. Public exploit code exists (VulnCheck POC), which raises practical exploitability for anyone who already holds a foothold, but the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. EPSS and a full SSVC decision (automatable, technical impact) were NOT provided in the input and cannot be assessed here - this is a gap. Net: the signals are internally consistent (medium CVSS, authenticated vector, limited impact, POC-but-no-KEV), pointing to a real post-authentication privilege-disruption bug worth patching, but not a widespread-exploitation crisis. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged authenticated account on a multi-tenant JeecgBoot instance sends a crafted PUT request to /sys/tenant/deleteTenantPackUser with attacker-chosen userId and packId values. Because the endpoint omits an authorization check, the request succeeds and removes a targeted victim (e.g. a tenant administrator) from a product pack, revoking their permissions. A public Python POC for this exact request is available, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot 3.9.5 and earlier allows any authenticated low-privileged user to remove arbitrary users from any tenant's product pack by sending attacker-controlled userId and packId values to PUT /sys/tenant/deleteTenantPackUser, silently revoking assigned permissions such as tenant administrator access. Exploitation requires only a valid low-privileged account (PR:L per the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) on an instance running in multi-tenant mode with tenant product packs configured, and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). The impact is confined to integrity and availability of permission assignments - no confidentiality exposure and no code execution - making this a genuine but moderate-priority issue rather than a top-tier emergency.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation centers on upgrading to a JeecgBoot release after 3.9.5 as soon as the maintainers publish one, then verifying through the project's changelog that the deleteTenantPackUser handler now enforces object-level authorization. Until then, the most direct compensating control is to add a server-side authorization check (or a request filter/interceptor) on PUT /sys/tenant/deleteTenantPackUser that confirms the caller holds an administrative role and that the requested userId/packId belong to the caller's own tenant - the trade-off is developer effort and the risk of breaking legitimate tenant-admin workflows if the check is too strict. Alternatively, block the endpoint entirely at the reverse proxy/WAF for any role other than platform super-administrator (side effect: tenant admins lose self-service pack management), or disable the tenant product-pack/multi-tenant feature if it is not actively used (eliminates the attack surface but removes functionality). Network-level restrictions limiting JeecgBoot administrative interfaces to trusted management networks reduce reachability, and since exploit code is publicly available, log monitoring for anomalous calls to /sys/tenant/deleteTenantPackUser and review of tenant-pack membership changes are recommended detection measures. Consult the CVE.org source reference and the VulnCheck advisory for the latest patch guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform, and this flaw sits in the multi-tenancy subsystem: the SysTenantController class handles tenant product-pack membership. The affected handler is the deleteTenantPackUser endpoint (mapped to PUT /sys/tenant/deleteTenantPackUser, source lines 787-791 of SysTenantController.java as cited in the CVE references), which processes caller-supplied userId and packId parameters from the request body without verifying that the caller is authorized to modify the target tenant or user. This is a classic CWE-862 Missing Authorization defect: authentication is enforced at the framework level, but object-level/role-level authorization is absent, so the endpoint trusts arbitrary identifiers. The single affected CPE, cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*, indicates that all released versions through 3.9.5 are in scope per the vendor/VulnCheck advisory. Because the operation only deletes a tenant-pack user association, the resulting impact is loss of assigned privileges (including tenant administrator role assignments) rather than data disclosure or remote code execution.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable endpoint exploitable by any low-privileged authenticated user with no user interaction; impact is limited to unauthorized modification/removal of permission assignments, so C:N with I:L and A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB