JeecgBoot versions through 3.9.5 contain a missing authorization flaw in the /sys/tenant/changeOwenUserTenant endpoint. The vulnerability lets any authenticated user POST a tenantId and userId to reassign that tenant’s owner to another user, including themselves. This can allow low‑privileged attackers to become the owner of a tenant or dismiss the legitimate owner, potentially leading to unauthorized access to tenant data and services. The weakness is a classic missing authorization flaw identified as CWE‑862.

The affected product is JeecgBoot, versions up to and including 3.9.5. Attackers can exploit the flaw by sending requests to the /sys/tenant/changeOwenUserTenant endpoint, which is part of the system module controller code.

The vulnerability is rated with a CVSS score of 7.1, indicating moderate to high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, so there is currently no evidence of widespread exploitation. The likely attack vector requires a valid authenticated session; an attacker would need to log in as a normal user or obtain a user’s credentials to manipulate tenant ownership. Once authenticated, the attacker can submit a POST request with the target tenantId and desired userId, causing the ownership transfer with no additional checks.