CVE-2026-108637 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw manifests as an insecure direct object reference or broken function level authorization issue within the application's user management module. The core technical deficiency lies in the backend API endpoint DELETE /sys/user/deleteUserGroupBatch, which is designed to remove members from specific user groups. However, the implementation fails to enforce adequate permission checks on this operation. Specifically, the server does not verify whether the authenticated user initiating the request possesses administrative privileges or belongs to a role with sufficient authority to modify group compositions. Furthermore, the endpoint lacks proper tenant isolation checks, which is particularly severe in multi-tenant SaaS environments where data segregation between different organizations is paramount for security and compliance.
From an operational perspective, this vulnerability allows any authenticated user with low-level privileges to execute destructive actions against administrator-maintained structures. By supplying arbitrary groupId values along with comma-separated userIds, a malicious actor can delete entries from the sys_ugroup_user database table without authorization. This capability effectively enables attackers to disrupt group memberships, potentially locking out legitimate users or removing security-critical personnel from essential groups such as administrators, auditors, or project leads. The absence of tenant checks exacerbates the risk by allowing cross-tenant data manipulation if the application is deployed in a multi-tenancy architecture. An attacker could theoretically remove members belonging to other tenants, leading to significant operational disruption and potential compliance violations related to data integrity and segregation requirements.
The impact extends beyond simple membership modification. By manipulating group memberships, an attacker can indirectly influence access control decisions within the application if those groups are tied to specific roles or permissions. For instance, removing a user from a restricted group might inadvertently grant them broader access if that removal triggers a fallback permission logic, or conversely, locking out critical staff by removing them from operational groups. This tampering with administrator-maintained data undermines the trust model of the application and can serve as a precursor to more severe attacks such as privilege escalation or denial of service against specific user cohorts. The ability to alter these relationships without detection indicates a fundamental weakness in the security architecture, where identity verification is decoupled from authorization validation for sensitive administrative functions.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict role-based access control checks at the controller level before any database operations are executed. Developers must ensure that only users with explicitly defined administrative roles can invoke endpoints related to group membership management. Additionally, rigorous input validation and tenant context verification must be enforced for all requests involving multi-tenant data structures. The application should verify that the requesting user's tenant ID matches the tenant associated with the target groupId and userIds to prevent cross-tenant attacks. Regular security audits focusing on authorization logic and penetration testing of administrative endpoints are recommended to identify similar flaws in other parts of the system. Updating to a patched version where these checks are properly implemented is essential for restoring secure operation. This issue aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it exploits legitimate credentials to perform unauthorized actions that compromise integrity and availability within the application environment.