CVE-2026-108872: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and department ids to move users, including administrators, between departments and overwrite positions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need administrator privileges or user interaction.
What access and request capabilities does an attacker need?
The attacker needs valid authentication to the affected JeecgBoot instance and the ability to send PUT requests to /sys/user/batchEditUsers. They can supply arbitrary user IDs and department IDs in the request.
What changes can exploitation make?
An attacker can alter department assignments and overwrite positions for other users, including administrators. The described impact is unauthorized modification of user organizational assignments rather than disclosure or service disruption.
How can I determine whether an instance is affected?
JeecgBoot versions through 3.9.5 are affected according to the available data. Review whether authenticated non-administrative users can successfully submit PUT requests to /sys/user/batchEditUsers targeting other users and arbitrary departments.