CVE-2026-108663 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the SysTenantController component, targeting the deleteApply handler which is responsible for processing requests related to tenant administrator applications. The core technical deficiency lies in the absence of sufficient authorization checks that verify whether the authenticated user initiating the request possesses the requisite privileges to modify or reject applications belonging to other tenants. In a properly secured multi-tenant architecture, operations affecting specific tenant data must be strictly bound to the identity and permissions of the actor performing them. However, this implementation allows any logged-in user, regardless of their role or assigned scope within the system, to interact with endpoints designed for administrative actions.
From an operational perspective, this vulnerability enables low-privileged attackers to execute unauthorized state changes on tenant management workflows. By sending PUT requests containing specific parameters such as tenantId, packId, and userId, an attacker can target pending applications submitted by other users or entities within the system. The immediate consequence is that these pending applications are deleted from the queue, effectively rejecting them without proper justification or approval authority. This action triggers notifications to the applicants informing them of their rejection, thereby disrupting legitimate business processes and potentially causing reputational damage or operational delays for affected tenants. The ability to arbitrarily reject tenant administrator applications undermines the integrity of the onboarding process and can be used maliciously to block access for specific individuals or organizations within the platform.
This type of vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly those related to Privilege Escalation and Defense Evasion techniques where attackers manipulate system configurations or user states to achieve their objectives without detection through normal authorization channels. The exploitation requires only basic authentication credentials, making it accessible to a wide range of threat actors who have gained initial access to the application interface. Such unrestricted modification capabilities can lead to broader security implications if these rejected applications were gateways for higher-level administrative privileges within the tenant structure.
To mitigate this vulnerability, developers must implement robust authorization checks at the controller level before processing any delete or reject operations. It is essential to verify that the authenticated user has explicit permission to manage applications associated with the specified tenantId and userId. This can be achieved by integrating role-based access control (RBAC) policies that validate the current session's permissions against the required action scope. Additionally, implementing audit logging for all administrative actions related to tenant management will aid in detecting unauthorized attempts post-deployment. Upgrading to a patched version of JeecgBoot where these authorization gaps have been addressed is the primary remediation strategy, ensuring that only users with designated admin rights can interact with tenant application workflows.