CVE-2026-108660: JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs network access to the affected endpoint and a valid authenticated session.
What is the practical impact?
An attacker can provide another tenant's ID to change that tenant's applyStatus value. This can enable or disable tenant administrator applications across tenant boundaries.
How can I determine whether an instance is affected?
JeecgBoot versions through 3.9.5 are identified as affected. Review authenticated PUT requests to /sys/tenant/updateApplyStatus for tenant IDs that do not belong to the requesting user, especially changes to applyStatus.