JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any… (CVE-2026-108882)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysPositionController's removeUserPosition handler. Authenticated users can exploit this by sending crafted DELETE requests to remove sys_user_position entries, effectively detaching users from positions without detection. This represents a privilege escalation vector where low-privileged users can perform unauthorized modifications to user-position associations.

The vulnerability allows unauthorized modification of user-position relationships, which can lead to integrity issues in user role assignments. While it does not disclose sensitive information (no confidentiality impact), it impacts integrity and availability by allowing attackers to remove users from positions, potentially disrupting organizational role assignments. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected handler and monitor for suspicious DELETE requests targeting user-position associations.