The vulnerability is a missing authorization flaw that allows any authenticated user with low privileges to invoke the deleteGroupUser endpoint. By sending DELETE requests with chosen groupId and userId values, the attacker can remove a target user from any administrator‑maintained user group. This effectively reduces the privileges of the target user or can be used to modify group memberships without ownership or tenant checks. The flaw is identified as CWE-862, unauthorized access to data.

JeecgBoot versions up to and including 3.9.5 are affected. The vulnerability is located within the SysUserController of the jeecg-system-biz module. No other product versions are currently listed as vulnerable.

The CVSS score of 5.3 indicates moderate severity. The vulnerability is not listed in CISA KEV, so no publicly known exploits have been documented. Attackers must be authenticated to the application, but they can use any user credentials that lack administrative rights. Because the endpoint lacks role or tenant verification, the attack can be carried out by a low‑privileged account, making exploitation plausible in environments where user roles are not strictly enforced. The likely attack vector is HTTP DELETE requests to the deleteGroupUser endpoint, inferred from the description that the attacker can send DELETE requests.