CVE-2026-108657 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified vulnerability resides within the JeecgBoot framework, specifically affecting versions up to 3.9.5, and centers on a critical failure in access control mechanisms within the SysTenantController component. The core technical flaw is classified as an Insecure Direct Object Reference or more accurately, a Broken Access Control issue where the application fails to verify that the authenticated user initiating the request possesses the necessary privileges to perform the action of approving tenant administrator applications. This missing authorization check allows any logged-in user, regardless of their current role or permission level within the system, to interact with administrative endpoints intended exclusively for super administrators or designated security officers. The vulnerability exploits the lack of server-side validation on the identity and authority of the requester when handling sensitive state changes in tenant management workflows.
The operational impact of this flaw is severe as it enables privilege escalation from a standard authenticated user account to that of a tenant administrator. An attacker can exploit this by first submitting a pending application for tenant pack access using the doApplyTenantPackUser endpoint, which typically requires minimal or no special privileges depending on configuration. Subsequently, the attacker utilizes the PUT /sys/tenant/passApply endpoint to approve their own request. This action effectively grants them administrative control over any specific tenant within the multi-tenancy architecture of JeecgBoot. Once elevated to a tenant administrator role, the compromised account gains extensive capabilities including but not limited to managing user accounts, modifying system configurations, accessing sensitive data stored within that tenant's scope, and potentially leveraging further vulnerabilities within the application logic available only to administrators.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management, as it involves an actor obtaining privileges or permissions they are not explicitly granted by the system design. It also maps directly to MITRE ATT&CK technique T1078: Valid Accounts, specifically under the sub-technique of using valid accounts in a compromised capacity to escalate privileges and maintain persistence within the environment. The exploitation path demonstrates how improper enforcement of role-based access control can undermine the security boundaries between different user tiers, allowing lateral movement or vertical privilege escalation without requiring external exploits such as buffer overflows or injection attacks.
Mitigation strategies must focus on enforcing strict authorization checks at the controller level for all administrative actions. Developers should implement explicit permission verification within the passApply handler to ensure that only users with a predefined super-administrator role can execute tenant approval operations. This involves checking the current session's user roles against an allowlist of authorized roles before processing any state-changing requests related to tenant administration. Additionally, implementing audit logging for all administrative actions and applying principle of least privilege across all API endpoints will help detect unauthorized attempts early. Regular security code reviews focusing on access control logic are recommended to prevent similar misconfigurations in other parts of the application framework.