JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships… (CVE-2026-108638)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the deleteGroupUser handler of the SysUserController. Low-privileged authenticated users can exploit this by sending crafted DELETE requests with arbitrary groupId and userId parameters, allowing them to remove any user from any administrator-maintained user group. This bypasses ownership and tenant verification, leading to unauthorized modification of group memberships. The CVSS v3.1 base score is 4.3, reflecting low attack complexity but limited impact confined to integrity.

An attacker with low privileges who is authenticated can remove users from administrator-maintained groups without proper authorization. This can lead to unauthorized changes in group memberships, potentially disrupting administrative controls or access management. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a fix is available, restrict access to the affected deleteGroupUser functionality to trusted users only and monitor for suspicious DELETE requests targeting group memberships.