JeecgBoot EUVD-2026-97055

Requires (1) a valid authenticated account on the JeecgBoot instance, even a low-privileged one (CVSS PR:L), and (2) a MULTI-TENANT deployment, since the disclosure is cross-tenant - the attacker supplies another tenant's tenantId plus a fixed packCode such as superAdmin, accountAdmin or appAdmin to the getTenantPackInfo handler. No user interaction, special client, or non-default feature toggle is needed; the missing authorization check is in the standard SysTenant controller. Limiting factors: single-tenant or fully trusted-user deployments gain little, exposure is read-only PII (no write/code-execution), and the attacker must know or enumerate valid target tenantId values.

This is a genuine but modest-severity information-disclosure flaw, not a critical priority. All signals align on LOW real-world risk: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and explicitly requires PR:L - a valid authenticated low-privileged account - so this is not remote-unauthenticated. Impact is confined to confidentiality (VC:L), with no integrity or availability effect, consistent with CWE-862 missing authorization leaking administrator PII rather than enabling code execution or account takeover. A public POC exists (AnkesKasty cve-request-poc), which raises exploitability, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals and must not be conflated. The main thing to verify is deployment context: in a single-tenant or trusted-user JeecgBoot instance the cross-tenant disclosure is largely academic, whereas in a genuine multi-tenant SaaS deployment any authenticated tenant can enumerate other tenants' admin usernames, names, phones and departments - useful reconnaissance for follow-on phishing or password attacks. No conflicting signals were found; the chief gap is the absence of EPSS data to quantify exploitation probability.

An attacker who holds any low-privileged account on a multi-tenant JeecgBoot instance calls the getTenantPackInfo handler, supplying an arbitrary tenantId together with a fixed packCode such as superAdmin, accountAdmin or appAdmin. Because the handler performs no authorization check binding the caller to the requested tenant, it returns the target tenant's administrator usernames, real names, phone numbers and departments. A working POC for this exact request is publicly available, so exploitation requires only a valid session and knowledge of tenant IDs.