CVE-2026-108658: JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records, including house numbers used as tenant join codes and company profile fields.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. No user interaction is required.
What information can an attacker retrieve?
An attacker can retrieve full sys_tenant records belonging to other tenants. Exposed data includes tenant house numbers used as join codes and company profile fields.
How would an attacker enumerate other tenants' data?
The affected handler accepts tenant identifiers that can be iterated as small integers. An authenticated attacker can query successive tenant IDs to retrieve records from other tenants.
Which versions are identified as affected?
JeecgBoot through version 3.9.5 is identified as affected.