EUVD-2026-96602
GHSA-6qfv-pf2c-5773
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitCraft PUT to deleteApply with chosen IDs
-
ExecutionServer skips tenant authorization check
-
ImpactDelete pending application and notify rejection
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on the target JeecgBoot instance (CVSS PR:L) and that the multi-tenant feature be in use with at least one pending tenant-administrator application to delete. The attacker must be able to supply or enumerate valid tenantId, packId, and userId values for the targeted pending application. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, impact is confined to rejecting/deleting pending tenant applications (no data disclosure or service outage), and instances not using JeecgBoot's tenant application workflow are not meaningfully affected. |
| Impact | This is a genuine-but-moderate issue, not a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree: a remote, low-privileged authenticated attacker can exploit it over the network with low complexity and no user interaction, so the core signals are internally consistent. However, impact is deliberately narrow - only VI:L (low integrity) is set, with no confidentiality (VC:N) and no availability (VA:N) impact, reflecting that the flaw lets an attacker reject/delete other tenants' pending administrator applications but does not expose data or take down the service. Publicly available POC code (VulnCheck advisory plus a GitHub exploit script) raises practical exploitability, but there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation - POC availability and in-the-wild exploitation are distinct signals and should not be conflated. Net: a real, easily-reproducible broken-access-control bug with authenticated prerequisites and limited integrity-only impact, consistent with its 5.3 (Medium) rating rather than a critical emergency. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged account on a multi-tenant JeecgBoot instance enumerates or guesses tenantId/packId/userId values and sends a crafted PUT request to the SysTenantController deleteApply endpoint. Because the handler never checks that the caller owns or administers the target tenant, the pending tenant-administrator application is deleted and the applicant is notified of rejection. A public POC (poc_tenant_delete_apply.py) demonstrates the request, making reproduction trivial for any authenticated user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated, low-privileged user delete pending tenant-administrator applications belonging to other tenants via the SysTenantController deleteApply handler, which also sends rejection notifications to the affected applicants. Publicly available exploit code exists, though exploitation requires a valid low-privileged account plus valid or enumerable tenantId, packId and userId values for a pending application. Impact is limited to integrity of the tenant-onboarding workflow with no data disclosure or service outage, making this a genuine but moderate issue rather than a top-priority one.
RemediationAI
No vendor-released patch identified at time of analysis; the referenced GitHub link points to vulnerable code lines rather than a fix commit, and no fixed version is confirmed in the available data, so administrators should monitor the JeecgBoot project for a release later than 3.9.5 and the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-deleteapply for updated guidance. Until a fix ships, the most direct compensating control is to add an explicit authorization check to the deleteApply endpoint (for example a permission annotation plus a server-side verification that the calling user administers the tenant identified in the request, and that tenantId, packId and userId are validated rather than trusted as supplied) and to ship that change as a local source patch or reverse-proxy rule; blocking PUT requests to /sys/tenant/deleteApply at the gateway or WAF offers immediate protection but risks breaking legitimate tenant-application administration and must be scoped to non-admin roles with monitoring. Organizations that do not use the tenant application workflow can disable the multi-tenant feature entirely, accepting the loss of that functionality, and in all cases should review recent tenant-application deletions for unexpected rejections and restrict the number of accounts permitted to reach the tenant management endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot based low-code development platform whose multi-tenant administrative functions live in jeecg-module-system/jeecg-system-biz; the affected handler is SysTenantController.deleteApply (referenced at SysTenantController.java lines 849-853 in the vendor repository). The root cause is CWE-862 (Missing Authorization): the handler accepts PUT requests carrying caller-supplied tenantId, packId and userId parameters and performs the deletion without any permission or ownership check, so the server trusts identifiers supplied by the requester and acts on any tenant's pending application. This is a horizontal privilege escalation within an authenticated session rather than a truly unauthenticated bypass, which matches the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, integrity-only impact VI:L) and the independent CVSS 3.1 score of 5.3 (PR:L, I:L). The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates the flaw is present across all tracked JeecgBoot releases up to and including 3.9.5, and only deployments that enable the multi-tenant feature and have at least one pending tenant-administrator application are meaningfully exposed.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote low-complexity exploitation requires only a low-privileged authenticated account (PR:L), with no user interaction; impact is integrity-only (I:L) deletion of records, no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB