This vulnerability allows any authenticated user to read tenant administrator application data through the /sys/tenant/getTenantPackApplyUsers endpoint. The missing authorization check enables low‑privileged attackers to iterate the tenantId parameter and retrieve pending applicants’ usernames, real names, phone numbers and department information. The weakness is a typical missing authorization flaw (CWE‑862).

JeecgBoot products, specifically the JeecgBoot application up to and including version 3.9.5. The affected code resides in the SysTenantController component of the JeecgBoot system.

The CVSS score of 5.3 indicates a medium severity impact, while the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve legitimate users who can supply arbitrary tenantId values to harvest confidential applicant information. The absence of authorization controls permits attackers to enumerate user data across tenants with only authenticated access.