Vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

5.4

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108662 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling…

   CVSS 4.3 CVE-2026-108680
2. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any…

   CVSS 4.3 CVE-2026-108679
3. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated…

   CVSS 4.3 CVE-2026-108678
4. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users…

   CVSS 6.5 CVE-2026-108677
5. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows…

   CVSS 4.3 CVE-2026-108676
6. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108675
7. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108674
8. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated…

   CVSS 4.3 CVE-2026-108673
9. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows…

   CVSS 4.3 CVE-2026-108672
10. 8
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because…

    CVSS 6.5 CVE-2026-108671 Anthropic
11. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any…

    CVSS 4.3 CVE-2026-108670
12. 15
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro…

    CVSS 4.3 CVE-2026-108669 Apache Software Foundation
13. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any…

    CVSS 5.4 CVE-2026-108668
14. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt…

    CVSS 4.3 CVE-2026-108667
15. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any…

    CVSS 5.4 CVE-2026-108666
16. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user…

    CVSS 4.3 CVE-2026-108665
17. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…

    CVSS 4.3 CVE-2026-108664
18. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated…

    CVSS 4.3 CVE-2026-108663
19. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…

    CVSS 6.5 CVE-2026-108661
20. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT…

    CVSS 4.3 CVE-2026-108660