JeecgBoot EUVD-2026-97050

The attacker must possess a valid authenticated JeecgBoot account (PR:L) - the flaw is reachable by any logged-in low-privileged user, not anonymously. Exploitation targets the putCancelQuit handler of SysUserController and requires supplying target user ids together with a tenantId parameter or an X-Tenant-Id header. The condition that makes it exploitable is the absence of an authorization check on this handler; the limiting factor is that only tenant-membership state can be altered (restoring ended/pending/refused memberships to normal), with no confidentiality or availability impact, and a valid session is mandatory.

This is a genuine-but-moderate access-control issue, not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), and impact is limited to integrity only (VI:L) with no confidentiality or availability effect (VC:N/VA:N) and no scope change - consistent with the modest 5.3 base score. Publicly available exploit code exists (VulnCheck-reported POC), which raises practical exploitability, but this is NOT CISA KEV-listed and no EPSS score was provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. No SSVC/EPSS decision data was supplied, so automatability and real-world exploitation likelihood cannot be quantified from the input. Net: a valid, low-barrier broken-authorization flaw whose real-world risk is bounded by the need for a valid low-privilege account and by the narrow integrity-only impact (unauthorized restoration of tenant memberships), making it a reasonable patch-soon item rather than an emergency.

A low-privileged but authenticated user of a JeecgBoot deployment sends a crafted request to the putCancelQuit endpoint of SysUserController, supplying target user ids plus a tenantId parameter (or X-Tenant-Id header). Because the handler lacks an authorization check (CWE-862), the server restores ended, pending, or refused tenant memberships back to normal, re-granting access that administrators had revoked. A working POC is publicly available, lowering the skill required to reproduce the attack.