JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability that allows any authenticated user with low privileges to transfer tenant ownership by sending a POST request to /sys/tenant/changeOwenUserTenant. Attackers can specify userId and tenantId parameters to reassign tenant ownership to themselves or other members, removing the legitimate owner.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to create validation rules. This occurs via the SysCheckRuleController importExcel handler, where attackers can upload crafted Excel files to bypass permission checks and bulk-create system-wide encoding validation rules with arbitrary regular expressions.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController. This flaw allows authenticated users with low privileges to retrieve role codes of any user by supplying arbitrary userId values to the GET /sys/api/getRolesByUserId endpoint. This can enable enumeration of role assignments and identification of administrator accounts.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragPromptsController's queryById handler. This flaw allows low-privileged authenticated users to access AI prompt templates belonging to other users, including administrators. Attackers can enumerate prompt template IDs via an unprotected endpoint and retrieve sensitive prompt details without proper authorization.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the QuartzJobController's queryById handler. This flaw allows low-privileged authenticated users to access scheduled job records, including job class names, cron expressions, parameters, and status information that should be restricted to administrators. The vulnerability is identified as CVE-2026-108655 with a medium severity rating.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysTenantController's queryTenantAuthInfo handler. This flaw allows any authenticated user with low privileges to access other tenants' records by iterating through tenant IDs. The exposed data includes sensitive tenant information such as house numbers used as tenant join codes and company profile fields. The vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SystemApiController updateAvatar handler. This flaw allows any authenticated user, including low-privileged attackers, to change other users' avatars by sending crafted PUT requests with arbitrary user IDs and image URLs. The vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of avatar images.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler. This flaw allows any authenticated user to query tenant product packs by supplying arbitrary tenantId and userId parameters. As a result, low-privileged attackers can enumerate tenant product pack configurations and identify tenant administrators. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint. This flaw allows any authenticated user, including low-privileged attackers, to access tenant administrator application data by iterating the tenantId parameter. The exposed information includes usernames, real names, phone numbers, and departments of pending applicants for any tenant.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController. This endpoint lacks proper Shiro permission or role checks, allowing any authenticated user with low privileges to retrieve sensitive database connection details including JDBC URLs, usernames, and decrypted passwords.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysCategoryController. This flaw allows any authenticated user, including those with low privileges, to edit category dictionary nodes by sending POST or PUT requests to /sys/category/edit. Attackers can rename, recode, or move system-wide category nodes, affecting classification values used across forms. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysCategoryController importExcel handler. This flaw allows any authenticated user, including those with low privileges, to import crafted Excel files that bulk insert arbitrary nodes into the system-wide sys_category dictionary. This can lead to unauthorized modification of category dictionary entries.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysCategoryController delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete category dictionary nodes by exploiting unprotected endpoints that expose node IDs. The vulnerability can lead to deletion of entire sys_category subtrees, disrupting dependent forms and dictionary fields.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to remove members from user groups without proper permission checks. This occurs via the DELETE /sys/user/deleteUserGroupBatch endpoint, allowing attackers to specify any groupId and userIds to delete user-group associations, bypassing tenant and administrative controls.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries. Attackers can exploit unprotected endpoints to obtain node IDs and recursively delete entire sys_category subtrees, disrupting dependent forms and dictionary fields. The vulnerability has a medium severity with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to access other users' in-application messages. The vulnerability exists in the getOne handler of SysAnnouncementSendController, where attackers can use delivery record IDs obtained from the unprotected /sys/sysAnnouncementSend/list endpoint to retrieve message details such as titles, bodies, senders, and recipients.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartRoleController queryById handler. This handler lacks Shiro permission annotations, allowing low-privileged authenticated users to access department role information by sending a GET request with any id. The exposed data includes role names, codes, descriptions, and audit fields. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysAnnouncementSendController. This flaw allows authenticated users to modify other users' message delivery records by exploiting insufficient access controls. Attackers can retrieve delivery IDs via a GET request and then submit edits to alter read flags, recipient IDs, or linked announcements, potentially hiding messages from intended recipients. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships. This occurs via the deleteGroupUser handler in SysUserController, enabling attackers to send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained group without ownership or tenant checks. The vulnerability has a medium severity score of 4.3 CVSS v3.1.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user, including low-privileged ones, to permanently delete data dictionaries and their items. This occurs via the deletePhysic handler of SysDictController, where DELETE requests to /sys/dict/deletePhysic/{id} bypass the recycle bin and irreversibly remove data.