CVE-2026-108876: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need user interaction.

Q: What does an attacker need to provide to exploit it?

The attacker needs user IDs and a tenant identifier. The tenant can be specified through the tenantId parameter or the X-Tenant-Id request header.

Q: What is the impact of successful exploitation?

An attacker can cancel resignations and restore tenant memberships that are ended, pending, or refused to normal status. The reported impact is limited to integrity; no confidentiality or availability impact is listed.

Q: Which versions are affected?

JeecgBoot through version 3.9.5 is affected.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended, pending, or refused tenant memberships to normal.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need user interaction.

What does an attacker need to provide to exploit it?

The attacker needs user IDs and a tenant identifier. The tenant can be specified through the tenantId parameter or the X-Tenant-Id request header.

What is the impact of successful exploitation?

An attacker can cancel resignations and restore tenant memberships that are ended, pending, or refused to normal status. The reported impact is limited to integrity; no confidentiality or availability impact is listed.

Which versions are affected?

JeecgBoot through version 3.9.5 is affected.

CVE-2026-108876: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide to exploit it?

What is the impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide to exploit it?

What is the impact of successful exploitation?

Which versions are affected?