JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any… (CVE-2026-108875)

CVE-2026-108875 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the SysUserController addSysUserGroup handler. The flaw permits any authenticated user to send POST requests containing arbitrary user IDs and a groupId, enabling unauthorized modification of user group memberships. This allows low-privileged users to add any user to administrator-controlled groups without validation. The vulnerability is classified under CWE-862 (Missing Authorization). No known exploits in the wild have been reported, and no patch or remediation details are provided in the source data.

The vulnerability allows unauthorized modification of user group memberships, potentially enabling privilege escalation or unauthorized access to administrative functions. However, it does not impact confidentiality or availability directly. The medium severity score reflects the limited scope of impact restricted to integrity of user group assignments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected handler where possible and monitor for suspicious activity related to user group modifications. Avoid granting unnecessary authenticated access to untrusted users.