CVE-2026-108661: JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant

Q: What access does an attacker need to exploit this issue?

The attacker needs an authenticated JeecgBoot account. A low-privileged user can exploit the endpoint without user interaction.

Q: What is the practical impact of successful exploitation?

An attacker can submit arbitrary userId and tenantId values to transfer ownership of a tenant to a tenant member, including the attacker. This can remove the legitimate tenant owner and give the attacker control associated with ownership.

Q: Which deployments are affected?

JeecgBoot versions through 3.9.5 are identified as affected. The vulnerability is in the POST /sys/tenant/changeOwenUserTenant endpoint.

Published Oct 10, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 10, 2026

CVE Published

via MITRE·09:49 PM

Data Sourced

via MITRE·09:49 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs an authenticated JeecgBoot account. A low-privileged user can exploit the endpoint without user interaction.

What is the practical impact of successful exploitation?

An attacker can submit arbitrary userId and tenantId values to transfer ownership of a tenant to a tenant member, including the attacker. This can remove the legitimate tenant owner and give the attacker control associated with ownership.

Which deployments are affected?