Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Missing authorization allows any authenticated user to reject tenant administrator applications
Action: Patch
AI Analysis

Impact

JeecgBoot through version 3.9.5 contains a missing authorization flaw in the SysTenantController deleteApply handler. The flaw allows any authenticated user to send PUT requests with arbitrary tenantId, packId, and userId parameters to delete pending administrator applications within any tenant. Consequently, low‑privileged attackers can force rejection of tenant admin requests, denying legitimate applicants access and potentially disrupting tenant administration processes.

Affected Systems

The affected product is JeecgBoot, versions up to and including 3.9.5. Users running these releases are susceptible to the flaw.

Risk and Exploitability

The vulnerability is assigned a CVSS score of 5.3, indicating moderate severity. Exploitation requires only authentication to the application, but no elevated privileges. No EPSS score is available and the flaw is not currently listed in the CISA KEV catalog. An attacker can craft a PUT request to /sys/tenant/deleteApply with chosen tenantId, packId and userId values to delete pending applications and notify applicants of rejection. The attack would affect the integrity and availability of tenant admin workflows within the affected organization.

Generated by OpenCVE AI on October 11, 2026 at 00:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated version of JeecgBoot that includes proper authorization checks for the deleteApply endpoint
  • Restrict the deleteApply operation so that only users with tenant administrator roles can invoke it by configuring role‑based access control
  • Audit and monitor calls to deleteApply to detect and investigate unauthorized request patterns

Generated by OpenCVE AI on October 11, 2026 at 00:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecgboot
Vendors & Products Jeecg jeecgboot

Sat, 10 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.
Title JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-862
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg Boot Jeecgboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T02:38:21.226Z

Reserved: 2026-10-10T20:19:29.709Z

Link: CVE-2026-108663

cve-icon Vulnrichment

Updated: 2026-10-14T02:38:17.864Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T22:16:42.780

Modified: 2026-10-14T03:17:19.167

Link: CVE-2026-108663

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T11:45:17Z

Weaknesses