CVE-2026-108876: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended, pending, or refused tenant memberships to normal.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need user interaction.
What does an attacker need to provide to exploit it?
The attacker needs user IDs and a tenant identifier. The tenant can be specified through the tenantId parameter or the X-Tenant-Id request header.
What is the impact of successful exploitation?
An attacker can cancel resignations and restore tenant memberships that are ended, pending, or refused to normal status. The reported impact is limited to integrity; no confidentiality or availability impact is listed.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.