JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members… (CVE-2026-108637)

CVE-2026-108637 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5. The flaw allows authenticated users with low privileges to invoke the DELETE /sys/user/deleteUserGroupBatch API endpoint to remove user group members arbitrarily. The vulnerability arises because the system does not enforce permission or tenant checks on the supplied groupId and userIds, enabling unauthorized tampering with administrator-maintained groups.

The vulnerability allows unauthorized modification of user group memberships, potentially disrupting group-based access controls and administrative configurations. While it does not directly impact confidentiality or availability, it can lead to integrity loss by unauthorized removal of users from groups, possibly weakening security policies or causing operational issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the DELETE /sys/user/deleteUserGroupBatch endpoint to trusted users only and monitor for suspicious usage. Implement additional authorization checks at the application or network level if possible.