JeecgBoot versions up to 3.9.5 suffer a missing authorization flaw that lets low‑privileged authenticated users remove any member from any user group by calling the DELETE /sys/user/deleteUserGroupBatch endpoint. This action deletes rows from the sys_ugroup_user table without applying permission or tenant checks, enabling attackers to tamper with administrative group memberships and potentially elevate their own authority or reduce the effectiveness of security controls.

The vulnerability affects JeecgBoot applications deployed on the JeecgBoot platform, specifically all releases through and including version 3.9.5. No corrected version is indicated in the available data, so any deployment on 3.9.5 or earlier is susceptible.

The CVSS score of 5.3 indicates a moderate impact if exploited. The EPSS score is not available, suggesting that the probability of exploitation is not quantified but could be low to moderate. Since the flaw requires an authenticated session, an attacker would need to obtain user credentials or otherwise gain access through other authentication channels. The flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of reporting. If an attacker can authenticate, they can directly manipulate group memberships, creating a path for privilege escalation within the system.