JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user… (CVE-2026-108621)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysPositionController's edit handler. Authenticated users can exploit this by retrieving position IDs from an unguarded list endpoint and then submitting PUT or POST requests to modify position attributes without proper permission validation. This constitutes a CWE-862 (Missing Authorization) issue and impacts the integrity of organizational position data.

The vulnerability allows low-privileged authenticated users to alter organizational position information, including names, codes, and ranks. This could lead to unauthorized changes in organizational structure data, potentially affecting business processes or access controls that rely on accurate position information. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /sys/position/edit endpoint to only trusted users and monitor for unusual modification activity. Implement additional authorization checks at the application level if possible.