EUVD-2026-97049
GHSA-2qrq-xr6v-mr65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliverySend POST to addSysUserGroup with arbitrary user ids and groupId
-
ExploitServer skips authorization check
-
ExecutionTarget users added to privileged group
-
ImpactUnauthorized privilege/group escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on a reachable JeecgBoot instance at version 3.9.5 or earlier, held by even a low-privileged user (PR:L) - the SysUserController addSysUserGroup handler performs no authorization/permission check before adding supplied user ids to the specified groupId. No user interaction, no special non-default configuration, and no administrative role are needed; the only meaningful limiting factor is that the attacker must first obtain or create an authenticated account, so instances that restrict account provisioning or are not network-exposed to untrusted users face materially lower risk. |
| Impact | This is a genuine but moderate-severity access-control flaw (CWE-862 Missing Authorization), not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring a low-privileged authenticated account (PR:L). Impact is limited to integrity (VI:L) with no confidentiality or availability effect (VC:N/VA:N), matching a flaw that lets a user manipulate group membership rather than read data or crash the service. Positive exploitation signals: VulnCheck has published an advisory and a public Python POC exists, so exploitation is practically demonstrated and trivial for anyone with a valid account. Tempering signals: there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of widespread or active exploitation - this remains a POC-stage issue requiring prior authentication, which bounds real-world risk. Net: prioritize patching on internet-facing or multi-tenant JeecgBoot deployments where low-privileged accounts are broadly provisioned, but it does not warrant emergency out-of-band response on its own. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privileged JeecgBoot account (e.g., a self-registered or basic business user) sends a crafted POST request to the SysUserController addSysUserGroup endpoint supplying arbitrary user ids and a target groupId. Because the handler performs no authorization check, the attacker adds themselves or confederate accounts into administrator-maintained groups, escalating effective privileges. A public Python POC (poc_user_group_member_addition.py) already automates this request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user - including a low-privileged one - to add arbitrary accounts to administrator-maintained user groups by sending a POST request containing target user ids and a groupId to the SysUserController addSysUserGroup handler, which performs no permission check. Impact is integrity-only at moderate severity: attacker-controlled group membership changes, with no confidentiality or availability effect on the platform itself. Publicly available exploit code exists, and there is no CISA KEV listing, so confirmed active exploitation in the wild has not been observed at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary fix is to apply whatever fixed JeecgBoot build the vendor publishes once available and track the CVE record and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-addsysusergroup) for the fix version; do not assume an unversioned commit reference is a released patch. Until then, the most effective compensating control is to add the missing authorization check directly in SysUserController.addSysUserGroup (or an interceptor/filter covering it) so the handler verifies the caller holds the appropriate group-management permission before writing membership rows - this is a code change, so it requires maintaining a fork and re-testing on each upgrade but it removes the root cause rather than hiding it. Where code changes are not feasible, front the application with a reverse proxy or API gateway rule that blocks POST requests to the addSysUserGroup handler (confirm the exact request mapping against SysUserController in your build before deploying the rule, since the rule is only as good as the path it matches) - the trade-off is that legitimate group administration through that endpoint will also be blocked, and any path change in an upgrade can silently invalidate the rule. Tighten account provisioning and self-registration so that untrusted parties cannot obtain the low-privileged authenticated session the exploit requires (PR:L), accepting the usability cost for onboarding flows that rely on open registration. Reduce network exposure of the JeecgBoot admin surface to trusted networks or VPN, since the vulnerability is only reachable by an authenticated session (AV:N, PR:L). Finally, because these are detective rather than preventive steps, monitor and alert on unexpected changes to user-group membership and on POST traffic to SysUserController group-management handlers, and periodically reconcile group membership against an authoritative source; this does not stop the modification but shortens the window before it is noticed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in JeecgBoot, a Spring Boot-based low-code development platform whose system module (jeecg-module-system/jeecg-system-biz) exposes SysUserController for user and user-group administration. The vulnerable method, addSysUserGroup (lines 799-823 in the referenced upstream commit), is a state-changing endpoint that accepts caller-supplied user ids and a groupId and writes the corresponding membership records without first evaluating the caller's permissions - no role check, no @RequiresPermissions/@PreAuthorize-style guard, and no ownership validation over the target group. Because the check is absent rather than misconfigured, the control is genuinely bypassed for any session that can reach the handler. The assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects a network-reachable, low-privilege-required, no-interaction issue whose only measurable effect is low-integrity modification of group membership; the published CVSS:4.0 score of 5.3 with VI:L is consistent with that reading. Group membership in JeecgBoot deployments often feeds downstream authorization and data-visibility decisions, so the practical blast radius depends on how groups are mapped to privileges in a given installation, but the assessed impact remains limited to integrity.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity but requires a low-privileged authenticated account (PR:L); impact is unauthorized group modification, so integrity-only (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to administrator-maintained groups without permission checks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB