JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the SysPositionController removeUserPosition handler. This flaw allows any authenticated user, including low-privileged attackers, to send DELETE requests with arbitrary userIds and positionId values. As a result, attackers can remove users from positions without proper authorization or logging. The vulnerability has a medium severity score of 5.4 (CVSS 3.1).
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysMessageController delete handler. This flaw allows low-privileged authenticated users to delete message records by sending DELETE requests with arbitrary IDs. The vulnerability enables attackers to erase any sys_sms row without ownership verification, potentially disrupting notification records.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysUserController's queryChildrenByUsername handler. This flaw allows any authenticated user, including low-privileged attackers, to retrieve other users' account information such as names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users manage.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysUserController addSysUserGroup handler. This flaw allows any authenticated user, including low-privileged attackers, to modify user group memberships by sending crafted POST requests. Specifically, attackers can add arbitrary users to administrator-maintained groups without proper permission checks. The vulnerability has a CVSS score of 4.3, indicating medium severity. No patch or remediation information is provided in the available data.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements. Exploitation involves calling the POST /sys/api/sendSysAnnouncement endpoint with arbitrary values for title, content, fromUser, and toUser, enabling forged announcements to be delivered via WebSocket, WeCom, DingTalk, and Feishu.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to modify any department. By calling the PUT /sys/user/doUpdateDepartInfo endpoint, attackers can rename or re-parent departments and alter department heads without proper ownership or tenant checks. This vulnerability does not impact confidentiality or availability but allows unauthorized modification of department information.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysRoleController saveDatarule handler. This flaw allows low-privileged authenticated users to modify role data rules by sending crafted parameters, potentially altering or clearing row-level data filters. The vulnerability can lead to unauthorized widening of data access or modification of filtering rules for other roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the putCancelQuit handler of SysUserController. This flaw allows any authenticated user, including low-privileged attackers, to cancel user resignations by supplying user IDs and tenant identification parameters. The vulnerability enables restoration of ended, pending, or refused tenant memberships to normal status without proper authorization.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the batchEditUsers handler of SysUserController. This flaw allows any authenticated user with low privileges to modify user department assignments by sending crafted PUT requests. Attackers can move users, including administrators, between departments and overwrite their positions without proper authorization. The vulnerability has a medium severity score of 4.3 (CVSS 3.1). No patch or remediation information is currently provided.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling a specific API endpoint. This flaw enables low-privileged users to arbitrarily set user IDs, department IDs, and status values, potentially elevating users to department head roles or demoting existing ones. The vulnerability impacts the integrity of department-scoped views within the application.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to publish templated system announcements. Attackers with low privileges can exploit this by sending crafted requests to the POST /sys/api/sendBusTemplateAnnouncement endpoint, specifying templateCode, toUser, and a forged fromUser. This enables sending notifications to arbitrary users via multiple channels including WebSocket, DingTalk, WeCom, Feishu, and UniPush. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the saveDatarule handler of the SysDepartRoleController. This flaw allows low-privileged authenticated users to modify department role data rules by sending crafted parameters. Exploitation can lead to unauthorized widening of row-level data access or alteration of filtering rules for other department roles.
A SQL injection vulnerability exists in erzhongxmu Jeewms up to version 3.7 in the getTreeData function of the Autocomplete Data Handler component. This vulnerability allows remote attackers with low privileges to manipulate the searchVal argument, potentially leading to unauthorized data access or modification. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is recommended to remediate the issue.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. This flaw enables low-privileged users to supply an arbitrary userId parameter and retrieve another user's complete permission set, potentially identifying administrator accounts. The vulnerability has a medium severity with a CVSS score of 4.3.
A security vulnerability (CVE-2026-108683) exists in zhayujie CowAgent up to version 2.1.9 in the Media Download Handler component. The flaw involves uncontrolled memory allocation triggered remotely, potentially leading to denial of service. The vulnerability has a low severity score of 4.3 and does not impact confidentiality or integrity. Upgrading to version 2.2.0 resolves the issue.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler. This flaw allows any authenticated user to read other users' role assignments by supplying an arbitrary userId parameter. Low-privileged attackers can exploit this to identify administrator accounts without having the required system:user:queryUserRole permission. The vulnerability has a medium severity with a CVSS score of 4.3.
thClaws versions through 0.141.0 have a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint. This flaw allows attackers who can plant a symbolic link under the allowed inputs/ prefix to cause authenticated uploads to write or truncate files outside the intended workspace with daemon privileges. The vulnerability has a low severity rating and a CVSS score of 4.2.
CoreShop versions through 2026.2.2 have a missing authorization vulnerability that allows low-privileged backend users to list resources that should be permission-restricted. This occurs because the ResourceController's listAction does not perform the required isGrantedOr403() authorization check. As a result, authenticated Pimcore users without proper resource permissions can enumerate sensitive entities such as payment providers, carriers, price rules, stores, and tax rules including their IDs, names, and identifiers.
Vearch versions 3.5.2 through 3.5.9 have an authorization vulnerability in the Role.HasPermissionForResources function. This flaw causes the system to ignore stored ReadOnly or None privilege levels for resources assigned to a role. As a result, authenticated non-root users can perform unauthorized actions such as upserting and deleting documents despite having only read-only access. They can also escalate their privileges by calling PUT /roles to grant themselves WriteRead access, potentially gaining cluster administrator rights.
Lightdash versions through 2.556.0 have an authorization bypass vulnerability that allows authenticated organization members to delete personal access tokens belonging to other users by specifying their UUID. This flaw enables attackers to revoke tokens across organizations, disrupting API integrations.