CVE-2026-108656: JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need tenant-administrator privileges.
What information can an attacker obtain?
An attacker can enumerate tenantId values and retrieve pending tenant administrator application data for other tenants. Exposed fields include usernames, real names, phone numbers, and departments.
Are unauthenticated deployments exposed?
The affected endpoint requires authentication, so an unauthenticated external attacker cannot exploit this issue directly. Any account with valid authentication can be sufficient.
How can I determine whether my instance is being targeted or has been exposed?
Review requests to GET /sys/tenant/getTenantPackApplyUsers for tenantId values accessed by users who are not authorized to administer those tenants. Repeated requests across multiple tenantId values are consistent with enumeration.