CVE-2026-108620: JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all sysposition rows and orphan user-position assignments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. No elevated administrative role is required.
What does an attacker need to delete positions?
The attacker needs an authenticated session and position IDs. The IDs can be obtained from the unguarded list endpoint, then supplied as comma-separated values to the deleteBatch handler.
What is the practical impact of successful exploitation?
An attacker can delete all rows in sys_position. This can orphan user-position assignments and disrupt organizational position data.
Are installations through version 3.9.5 affected?
The affected range stated is JeecgBoot through 3.9.5. The provided information does not identify a fixed version or an available workaround.