CVE-2026-108656 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's multi-tenant architecture. Specifically, the flaw resides in the SysTenantController endpoint GET /sys/tenant/getTenantPackApplyUsers, which is designed to retrieve information regarding users applying for tenant administrator roles. The core technical deficiency is a missing authorization check that fails to validate whether the authenticated user initiating the request possesses the necessary privileges or belongs to the specific tenant context being queried. This oversight allows any authenticated user, regardless of their role or assigned permissions within the system, to interact with this endpoint and extract sensitive data associated with other tenants.
From an operational perspective, this vulnerability enables low-privileged attackers to perform unauthorized enumeration of pending administrator applications across all available tenants in the SaaS environment. By iterating through various tenantId parameters, an attacker can systematically harvest personally identifiable information including usernames, real names, phone numbers, and departmental affiliations for individuals who have applied for elevated privileges within those organizations. This capability transforms a simple authentication bypass into a significant data exfiltration risk, as it exposes the identity landscape of multiple distinct entities that are supposed to be isolated from one another under standard multi-tenant security models.
The impact extends beyond mere privacy violations and directly facilitates further malicious activities such as targeted phishing attacks or social engineering campaigns against potential new administrators. The exposure of real names and contact information provides attackers with high-confidence targets for credential harvesting or impersonation attempts, potentially leading to account takeovers if combined with other vulnerabilities like weak password policies or lack of multi-factor authentication. Furthermore, the ability to map out administrative structures within target organizations aids in strategic planning for more advanced persistent threats aiming at privilege escalation.
This flaw is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK techniques related to Discovery and Collection, specifically T1078 Valid Accounts which describes the use of legitimate credentials to access resources without proper authorization checks. The vulnerability highlights a common pitfall in web application development where API endpoints are exposed without sufficient middleware validation for tenant isolation or role-based access control enforcement.
To mitigate this risk, immediate remediation should focus on implementing strict server-side authorization logic within the SysTenantController method. Developers must ensure that every request to retrieve tenant-specific data verifies both the user's current session permissions and their association with the requested tenantId parameter. Implementing a check that confirms the authenticated user is either an existing administrator of the target tenant or holds a global super-admin role capable of viewing cross-tenant data would effectively neutralize this attack vector. Additionally, applying principle of least privilege to API endpoints and conducting regular security audits focusing on access control lists can prevent similar misconfigurations in future releases.