CVE-2026-108662: JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit the affected endpoint. The attacker does not need elevated tenant administration privileges.
What does an attacker need to provide?
The attacker needs to send a PUT request to /sys/tenant/deleteTenantPackUser with arbitrary userId and packId values in the request body. These values can target users and product packs belonging to other tenants.
What is the practical impact?
An attacker can remove users from tenant product packs, which revokes the permissions provided by those packs. This can include removing tenant administrator access and can affect availability of authorized access for targeted users.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.