Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized information disclosure and limited privilege escalation
Action: Apply Patch
AI Analysis

Impact

JeecgBoot through version 3.9.5 contains a missing authorization flaw in the SysTenantController listPackByTenantUserId endpoint. Any authenticated user can supply arbitrary tenantId and userId values and retrieve the configuration of a tenant’s product packs. This reveals which users are tenant administrators and can expose sensitive configuration data. The vulnerability is classified as a missing authorization issue, allowing low‑privileged users to access protected information that should be confined to administrators.

Affected Systems

The flaw affects the JeecgBoot platform for all releases up to and including 3.9.5. Users running JeecgBoot in these versions are susceptible if they have any valid authentication credentials.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, so current exploitation probability is undetermined. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable via any authenticated session that can reach the vulnerable endpoint. An attacker who can authenticate (even with minimal privileges) can enumerate tenant information and potentially use the disclosed administrator identity in further attacks.

Generated by OpenCVE AI on October 11, 2026 at 00:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade JeecgBoot to a version that excludes the missing authorization flaw (e.g., version 4.0.x or later).
  • Add explicit authorization checks to the listPackByTenantUserId endpoint, ensuring only users with tenant administrator roles can access tenant product pack data.
  • Review and harden all authenticated endpoints in the system, applying principle of least privilege and conducting regular security testing to detect missing authorization defects.

Generated by OpenCVE AI on October 11, 2026 at 00:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecgboot
Vendors & Products Jeecg jeecgboot

Sat, 10 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.
Title JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-862
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg Boot Jeecgboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T12:41:21.600Z

Reserved: 2026-10-10T20:19:28.423Z

Link: CVE-2026-108659

cve-icon Vulnrichment

Updated: 2026-10-13T12:41:02.231Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T22:16:42.207

Modified: 2026-10-13T20:43:34.023

Link: CVE-2026-108659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T11:45:17Z

Weaknesses