JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant… (CVE-2026-108662)

CVE-2026-108662 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5. The flaw permits low-privileged authenticated users to invoke the PUT /sys/tenant/deleteTenantPackUser API endpoint with arbitrary userId and packId parameters, enabling them to remove any user from any tenant's product pack. This unauthorized removal can revoke critical permissions such as tenant administrator rights, potentially disrupting tenant management.

The vulnerability allows unauthorized privilege revocation by low-privileged authenticated users, which can lead to denial of access or administrative control for legitimate tenant users. There is no direct confidentiality impact, but integrity and availability are affected as users can be removed improperly from tenant product packs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity related to tenant user management.