The bug is a missing authorization check in JeecgBoot’s SysTenantController passApply handler. When an authenticated user sends a PUT request to /sys/tenant/passApply, they can approve pending tenant administrator applications that they themselves submitted or that were submitted by others. The result is that the attacker obtains tenant administrator pack permissions, effectively elevating their privileges within the tenant. The weakness is a classic example of CWE‑862, Missing Authorization.

JeecgBoot, all releases through version 3.9.5 are affected. The vulnerability specifically resides in the SysTenantController component of the JeecgBoot system and targets the /sys/tenant/passApply endpoint. Any user who can authenticate against the system can potentially trigger the privilege escalation, regardless of their current role.

The CVSS score of 8.6 classifies this issue as a high‑severity privilege escalation. Because the vulnerability requires only standard authentication and no special privileges, the practical attack surface is large. With an authenticated user in any tenant, an attacker can submit or re‑approve a pending request and secure tenant administrator permissions. The absence of an EPSS score and a lack of listing in the CISA KEV catalog suggests there is currently no publicly known exploitation, but the high CVSS and the ease of triggering the flaw indicate a high potential for exploitation if a malicious actor gains authentication.