JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read… (CVE-2026-108881)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the getTenantPackInfo handler. Authenticated users with low privileges can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin, or appAdmin to retrieve sensitive administrator information from other tenants, including usernames, real names, phone numbers, and departments. This vulnerability allows unauthorized read access to tenant-specific product pack membership data.

The vulnerability allows unauthorized disclosure of administrator personal and organizational information across tenants. This could lead to privacy violations and potential reconnaissance for further attacks. However, it does not impact system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict authenticated user permissions where possible and monitor for suspicious access patterns related to tenant data.