JeecgBoot upto version 3.9.5 suffers from a missing authorization flaw that allows a low‑privileged authenticated user to invoke the /sys/tenant/deleteTenantPackUser API and specify any userId and packId in the request body. By doing so the attacker can remove a target user from a tenant’s product pack, effectively revoking that user’s permissions such as tenant administrator rights. The weakness is a classic access control failure (CWE‑862). The impact is limited to the affected user’s entitlement, but it can cascade to disrupting Tenant administration if an admin account is removed.

The vulnerability is present in the JeecgBoot framework supplied by the vendor JeecgBoot. Affected releases include all builds up to and including version 3.9.5. No patched versions are listed in the data, so administrators must check the vendor’s website for any update that addresses the authorization issue.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and this entry is not listed in CISA’s KEV catalog, suggesting that mass exploitation is currently low, but the lack of a public exploit does not guarantee absence of interest. Exploitation requires the attacker to be authenticated as any user with access to the API; therefore, the attack surface is internal or lateral within the application. Once authenticated, an attacker can repeatedly supply arbitrary identifiers to remove users, potentially destabilizing tenant management.