CVE-2026-108637: JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without permission or tenant checks, tampering with administrator-maintained groups.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker does not need elevated group-management permissions.
What does an attacker need to send to the vulnerable endpoint?
The attacker needs a request to DELETE /sys/user/deleteUserGroupBatch containing a target groupId and comma-separated userIds. The endpoint accepts arbitrary group and user identifiers without permission or tenant checks.
Are tenant boundaries enforced for this operation?
No. The affected endpoint performs no tenant checks, so an authenticated low-privileged user can target user-group membership rows without tenant-based authorization validation.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 are affected. Review whether DELETE /sys/user/deleteUserGroupBatch is available and whether low-privileged accounts can invoke it to remove members from groups they do not administer.