CVE-2026-108659: JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. No user interaction is required.
What information can an attacker obtain?
An attacker can enumerate product pack configuration for arbitrary tenants and identify which users are tenant administrators. The stated impact is limited to information disclosure; integrity and availability are not affected.
What request inputs are abused?
The vulnerable handler accepts tenantId and userId parameters without enforcing authorization for the requested tenant. An authenticated attacker can supply arbitrary values for both parameters.
How can defenders determine whether an instance is affected?
JeecgBoot versions through 3.9.5 are affected. Review access to the /sys/tenant/listPackByTenantUserId handler and test whether a low-privileged account can query product-pack data for a different tenant by changing tenantId and userId.