The vulnerability is a missing authorization flaw in the addSysUserGroup endpoint of JeecgBoot, permitting any authenticated user to alter user group membership. An attacker can send a POST request with any user ID and group ID, adding users to administrator‑maintained groups without permission checks. This enables low‑privileged users to gain elevated privileges and access restricted resources. The weakness is classified as CWE‑862, Missing Authorization.

JeecgBoot up to and including version 3.9.5 is affected. The issue exists in the SysUserController code handling group membership changes and is present in all releases released before the discovery of the bug.

The CVSS score of 5.3 indicates a medium impact; however, the attack requires that the attacker first authenticate to the application. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker with valid user credentials can exploit the endpoint to modify group memberships and elevate privileges, making the flaw potentially serious in environments where user accounts have broad access or where groups control sensitive functionality.