CVE-2026-108662 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in server-side access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw resides within the API endpoint PUT /sys/tenant/deleteTenantPackUser, which is designed to manage user assignments within tenant-specific product packs. In a properly secured multi-tenancy architecture, such operations must strictly validate that the authenticated actor possesses sufficient privileges for both the target tenant and the specific administrative action being performed. However, in this implementation, the backend logic fails to enforce these checks effectively against low-privileged authenticated users. Consequently, an attacker who has obtained valid credentials with minimal permissions can manipulate the request parameters to bypass intended restrictions.
The technical mechanism of exploitation relies on the ability to supply arbitrary values for userId and packId within the HTTP request body. Because the application does not verify whether the requesting user is authorized to modify the membership status of other users or access specific tenant packs, it processes these inputs blindly. By crafting a malicious PUT request with targeted identifiers, an attacker can remove any specified user from any designated product pack associated with the system's multi-tenancy structure. This lack of object-level authorization control allows for unauthorized state changes that are typically reserved for higher-ranking administrators or super-users within the tenant hierarchy.
The operational impact of this vulnerability is significant, particularly in environments relying on JeecgBoot for role-based access control and tenant isolation. The primary consequence is the revocation of critical permissions for targeted users. For instance, if an attacker targets a user holding the tenant administrator role, removing them from their product pack can effectively strip them of administrative capabilities, leading to service disruption or loss of management over that specific tenant environment. This capability undermines the integrity of the access control model and could be leveraged by malicious insiders or external attackers who have compromised low-level accounts to escalate privileges indirectly or cause denial of service through permission stripping.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it requires initial authentication but exploits the lack of proper authorization checks post-login. It also reflects aspects of privilege escalation by allowing lower-privileged entities to perform high-level administrative functions such as user management and role revocation. The absence of robust validation on input parameters like userId and packId further highlights a deficiency in secure coding practices regarding object reference verification, which is essential for maintaining the confidentiality and availability of multi-tenant applications.
To mitigate this vulnerability, developers must implement strict server-side authorization checks before processing any requests to delete or modify tenant pack memberships. The application should verify that the authenticated user has explicit administrative rights over both the target tenant and the specific product pack involved in the operation. Additionally, implementing role-based access control (RBAC) policies at the API level can ensure that only users with designated roles such as Tenant Admin are permitted to execute these sensitive operations. Regular security audits focusing on authorization logic and penetration testing against multi-tenancy features are recommended to identify similar gaps in other endpoints within the JeecgBoot framework.