JeecgBoot through version 3.9.5 includes a missing authorization flaw that allows any authenticated user to invoke the PUT /sys/tenant/updateApplyStatus endpoint. An attacker can choose an arbitrary tenant identifier and toggle its applyStatus field, effectively enabling or disabling tenant administrator applications for that tenant. This change can result in unauthorized access to administrative functionality across tenants, potentially allowing a low‑privileged user to take control of another tenant’s services.

The vulnerability is present in JeecgBoot versions up to and including 3.9.5. The affected code resides in the SysTenantController component of the JeecgBoot system module. Any installation of JeecgBoot released through 3.9.5 that has the /sys/tenant/updateApplyStatus endpoint exposed to authenticated users is impacted.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over HTTP/HTTPS, inferred from the fact that an authenticated user can call the PUT /sys/tenant/updateApplyStatus endpoint, and it requires only that the attacker possesses valid user credentials. No special privileges or additional exploits are needed. While the flaw does not provide arbitrary code execution, it enables cross‑tenant privilege escalation by changing tenant state, which poses a significant risk in multi‑tenant deployments.