CVE-2026-108638 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within JeecgBoot versions up to 3.9.5, specifically affecting the SysUserController component which manages system-level user administration tasks. This vulnerability is classified as a Broken Access Control issue, aligning with CWE-284 in the Common Weakness Enumeration taxonomy. The core technical deficiency lies in the deleteGroupUser handler method, which fails to enforce proper authorization checks before processing deletion requests for group memberships. In a secure implementation, any operation that modifies administrative data structures such as user groups must verify that the requesting authenticated user possesses sufficient privileges or explicit ownership of the target resource. However, this specific endpoint lacks these critical validation mechanisms, allowing it to process commands from users with minimal privilege levels who should not have access to group management functionalities.
The operational impact of this vulnerability is significant for organizations relying on JeecgBoot for identity and access management workflows. An attacker who has obtained valid credentials for a low-privileged account can exploit the missing authorization check by crafting HTTP DELETE requests containing arbitrary groupId and userId parameters. By manipulating these values, the attacker can remove any user from any administrator-maintained group regardless of whether they have ownership or tenant-based permissions associated with those entities. This capability effectively allows an unprivileged user to disrupt administrative operations, potentially locking out other users from necessary resources or altering security policies defined by group memberships. Such actions undermine the integrity of role-based access control models and can lead to unauthorized privilege escalation if critical groups are modified in ways that bypass intended restrictions.
From a threat modeling perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1078, which covers Valid Accounts, specifically focusing on how attackers leverage existing credentials to perform actions outside their authorized scope. The exploitation vector is remote and requires only authenticated access, making it particularly dangerous in environments where internal users may have varying levels of trust or security awareness. Once an attacker gains a foothold with low-level permissions, this flaw provides a straightforward path to escalate influence over the system's administrative structure without needing additional exploits for privilege escalation. The absence of tenant checks further exacerbates the risk in multi-tenant deployments, allowing cross-tenant interference where users from one organization could potentially affect group memberships belonging to another if shared infrastructure is not properly isolated at this layer.
To mitigate this vulnerability, immediate patching to a version of JeecgBoot later than 3.9.5 is recommended as the primary remediation strategy. For organizations unable to upgrade immediately due to compatibility constraints or operational dependencies, implementing compensating controls is essential. These include configuring web application firewalls to monitor and restrict DELETE requests targeting user management endpoints unless they originate from known administrative IP ranges or carry specific high-privilege session tokens. Additionally, developers should review the SysUserController implementation to ensure that all group modification operations enforce strict checks for both role-based permissions and tenant isolation boundaries before executing database changes. Regular security audits focusing on access control logic in administrative modules can help identify similar gaps where authorization is assumed rather than explicitly verified against current user context.