JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated… (CVE-2026-108663)

The vulnerability (CVE-2026-108663) in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysTenantController deleteApply handler. This allows authenticated users with low privileges to perform unauthorized actions by sending PUT requests with arbitrary tenantId, packId, and userId parameters. As a result, attackers can delete pending tenant administrator applications and trigger rejection notifications without proper permissions.

The vulnerability impacts the integrity of tenant administrator application processes by allowing unauthorized rejection of applications. It does not affect confidentiality or availability. The CVSS score of 4.3 (medium severity) reflects the limited impact, requiring authentication but allowing low-privileged users to cause unauthorized application deletions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected handler where possible and monitor for suspicious PUT requests targeting tenant administrator application deletions.