JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any… (CVE-2026-108620)

The vulnerability in JeecgBoot through version 3.9.5 is due to missing authorization checks in the SysPositionController deleteBatch handler. Authenticated users with low privileges can exploit this by sending a crafted request with position IDs, which they can retrieve from an unguarded list endpoint, to delete organizational positions and disrupt user-position relationships. This results in integrity and availability impacts on the affected data.

The vulnerability allows low-privileged authenticated users to delete organizational positions and orphan user-position assignments, leading to partial loss of data integrity and availability within the system. There is no confidentiality impact reported. The CVSS score is 5.4 (medium severity), reflecting the moderate impact of the issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and monitor for suspicious activity related to position deletions. Avoid exposing position ID lists without authorization checks.