CVE-2026-108638: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user with low privileges can exploit it. The attacker does not need ownership of the target group or user, and no tenant check is enforced.
What access and request are required to remove a group membership?
An attacker needs valid authenticated access and can send a DELETE request to the deleteGroupUser handler. They can supply arbitrary groupId and userId values to remove a selected user from a selected administrator-maintained group.
Which deployments are affected?
JeecgBoot versions through 3.9.5 are identified as affected. The provided information does not describe a configuration prerequisite, so deployments exposing this handler to authenticated low-privileged users should be considered at risk.
How can administrators determine whether exploitation may have occurred?
Review records and logs for DELETE requests to /sys/user/deleteGroupUser, particularly requests made by low-privileged accounts involving groupId and userId values unrelated to the requesting user. Also review group membership changes for unexpected removals from administrator-maintained groups.