CVE-2026-108872 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and department ids to move users, including administrators, between departments and overwrite positions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the backend administrative module. Specifically, the flaw resides in the batchEditUsers handler of the SysUserController class, which is designed to manage user attributes such as department assignments and job positions. In a properly secured application architecture, any operation that modifies sensitive identity data or alters organizational hierarchy must be strictly gated by role-based access control checks ensuring that only users with specific administrative privileges can execute these changes. However, in this implementation, the endpoint lacks sufficient authorization verification for authenticated sessions of lower privilege levels. This oversight allows an attacker who has successfully obtained valid credentials to interact directly with the API without possessing the requisite system administrator rights.
From a technical perspective, the exploitation vector involves sending HTTP PUT requests to the /sys/user/batchEditUsers endpoint. The payload typically includes arbitrary user identifiers and department or position IDs that define the target state for the affected accounts. Because the server processes these requests based solely on the presence of a valid authentication token rather than validating the requester's role against the requested action, an attacker can manipulate the database to reassign users across different organizational units. This capability extends beyond simple data modification; it effectively allows low-privileged actors to escalate their influence within the application by altering the structural relationships between user accounts and administrative roles.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and lateral movement within the compromised system. By moving an administrator account into a department or role that grants broader permissions, or conversely removing administrators from protected groups, attackers can undermine the integrity of the entire access control framework. This manipulation facilitates unauthorized data exposure, as users may gain visibility into sensitive information associated with their new departments. Furthermore, it enables persistent backdoor creation if combined with other vulnerabilities, allowing adversaries to maintain long-term access even after initial credentials are revoked or rotated. The ability to overwrite positions also disrupts organizational workflows and audit trails, complicating forensic investigations and compliance reporting efforts that rely on accurate user-role mappings.
This flaw aligns closely with CWE-284 Improper Access Control, as the application fails to enforce proper restrictions on authenticated users attempting to perform privileged actions. It is also categorized under MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass security controls and move laterally within a network or application environment. The lack of vertical privilege checks exemplifies common pitfalls in RESTful API design where developers assume that authentication implies authorization for all endpoints associated with the controller class.
To mitigate this vulnerability, immediate patching to version 3.9.6 or higher is required as it addresses these access control gaps. In environments where upgrading is not immediately feasible, a robust compensating control involves implementing strict role-based access checks at the service layer before any user modification logic executes. Developers should ensure that endpoints handling sensitive identity data verify that the requesting session possesses explicit admin-level permissions rather than relying on generic authentication tokens. Additionally, integrating automated security testing into the CI/CD pipeline can help detect such authorization flaws early in development by simulating low-privileged access attempts against administrative APIs. Regular audits of API endpoint configurations and adherence to principle of least privilege are essential practices to prevent similar misconfigurations in future releases.