The vulnerability is a missing authorization check in the getTenantPackInfo handler. Any authenticated user can submit a tenantId and common packCode values such as superAdmin, accountAdmin or appAdmin to obtain the list of users within that tenant. The disclosed data includes administrator usernames, real names, phones and departments, exposing sensitive account information.

The flaw affects JeecgBoot versions up to 3.9.5. Users running this version of the JeecgBoot system, regardless of deployment environment, are susceptible unless they have upgraded to a newer release.

The CVSS score of 5.3 signals a moderate impact level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the risk remains because any authenticated user can enumerate other tenants’ privileged data. Exploitation requires only valid credentials; once authenticated, the attacker can easily request the vulnerable endpoint to retrieve sensitive tenant information.