Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass allowing cross‑tenant data disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a missing authorization check in the SysTenantController's queryTenantAuthInfo endpoint. It lets any authenticated user request data for any tenant ID, exposing full sys_tenant records, including house numbers and company profiles. This can lead to cross‑tenant data disclosure for attackers with low privileges.

Affected Systems

JeecgBoot, all releases up to and including version 3.9.5. The issue resides in the SysTenantController within the jeecg-boot system module.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity. Because the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, the exploitation likelihood is unclear from publicly available data. However, any authenticated session can enumerate tenant IDs and retrieve sensitive tenant information, making the risk significant for multi‑tenant deployments where tenant data is confidential.

Generated by OpenCVE AI on October 11, 2026 at 00:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Roll out the latest JeecgBoot release that includes the authorization fix for the queryTenantAuthInfo endpoint.
  • If an urgent patch is not yet available, tighten tenant ID exposure by implementing server‑side validation that restricts queries to the authenticated user's own tenant or a whitelisting mechanism.
  • Enforce strict role‑based access control and audit logs for any tenant data access to detect and deter misuse.

Generated by OpenCVE AI on October 11, 2026 at 00:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecg-boot
Vendors & Products Jeecg jeecg-boot

Sat, 10 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.
Title JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-862
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg-boot Jeecg Boot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T02:37:45.886Z

Reserved: 2026-10-10T20:19:28.073Z

Link: CVE-2026-108658

cve-icon Vulnrichment

Updated: 2026-10-14T02:37:41.987Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T22:16:42.067

Modified: 2026-10-14T03:17:19.037

Link: CVE-2026-108658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T05:00:10Z

Weaknesses