CVE-2026-108621: JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit to alter position names, codes, and ranks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit the missing authorization check. The attacker needs network access to the application and valid credentials.
What information does an attacker need to modify a position?
The attacker needs a position ID. Position IDs can be obtained from the unguarded list endpoint, after which the attacker can submit PUT or POST requests to /sys/position/edit.
What changes can an attacker make?
An attacker can alter organizational position names, codes, and ranks. The available information describes an integrity impact and does not indicate confidentiality or availability impact.