The flaw is a missing authorization on the /sys/user/putCancelQuit endpoint in JeecgBoot. Any authenticated user can invoke this handler and cancel a resignation, effectively reversing a user’s departure. By providing a user id and tenant id, an attacker can restore a user’s membership to a tenant even after resignation has been processed. The weakness is a classic Missing Authorization defect (CWE-862) that compromises the integrity of user state and can lead to unauthorized privilege persistence.

JeecgBoot through version 3.9.5 and earlier. The vulnerable code resides in the SysUserController within the jeecg-boot system module. The issue is present in all deployments of the affected product up to and including the specified release.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only a valid authenticated session; no elevated privileges are needed. An attacker with valid credentials can use the endpoint to restore memberships, potentially enabling ongoing unauthorized access or abusively granting roles within the tenant. The simplest attack path involves sending a POST request with the user identifier and tenant context to the endpoint.