JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any… (CVE-2026-108659)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysTenantController's listPackByTenantUserId handler. Authenticated users can manipulate tenantId and userId parameters to access product pack information of any tenant, which should be restricted. This allows enumeration of tenant product pack configurations and reveals which users hold tenant administrator roles. The CVSS 3.1 vector indicates the attack requires network access with low complexity and low privileges, with limited confidentiality impact and no integrity or availability impact.

An attacker with valid authentication can enumerate product pack configurations across tenants and identify tenant administrators. This information disclosure could aid in further targeted attacks or privilege escalation attempts. There is no direct impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected handler to only authorized users and monitor for suspicious use of tenantId and userId parameters. Avoid exposing this API endpoint to low-privileged users if possible.