CVE-2026-108875: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to administrator-maintained groups without permission checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit the affected handler. The attacker does not need administrator-level permission checks to pass.
What access or request capabilities are required?
The attacker needs valid authentication and the ability to send POST requests to /sys/user/addSysUserGroup. They can supply arbitrary user IDs and a groupId in the request.
What is the practical impact?
An attacker can add arbitrary users to groups maintained by administrators. This changes user group membership without authorization and may grant the affected users whatever access is associated with those groups.