CVE-2026-108875 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to administrator-maintained groups without permission checks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework, specifically affecting versions up through 3.9.5, in the SysUserController component responsible for managing system user configurations. The vulnerability is classified as a missing authorization issue, technically corresponding to CWE-862: Missing Authorization. This defect occurs during the execution of the addSysUserGroup handler, which is designed to assign users to specific administrative or operational groups. In a properly secured implementation, this endpoint would verify that the requesting user possesses sufficient privileges, such as system administrator rights, before modifying group memberships. However, due to the absence of these critical access control checks, the application fails to validate whether the authenticated caller has the right to perform this action on behalf of other users or for specific groups.
This architectural oversight allows any authenticated user with low-level privileges to exploit the endpoint by sending crafted POST requests containing arbitrary user identifiers and target group IDs. By manipulating these parameters, an attacker can forcibly add themselves or other compromised accounts into high-privilege groups that are typically maintained exclusively by system administrators. This bypass of access control mechanisms effectively elevates the attacker's permissions within the application environment without requiring additional authentication factors or exploiting separate software bugs. The lack of server-side validation means the framework blindly accepts and processes these requests, trusting the client-supplied data regarding who should be granted elevated status.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of the role-based access control model implemented by JeecgBoot applications. Once an attacker successfully adds a user account to an administrator-maintained group, that account gains unrestricted or significantly expanded access to sensitive features, data stores, and configuration settings intended only for trusted personnel. This can lead to full system compromise, allowing the attacker to exfiltrate confidential information, modify critical application configurations, install malicious modules, or disrupt service availability. Furthermore, because this action is performed by an authenticated user, it may evade basic intrusion detection systems that rely on unauthenticated access attempts as a primary indicator of attack activity.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates privilege escalation and can be leveraged for lateral movement within the application's logical boundary. Attackers often utilize such flaws to establish persistent backdoors by creating new administrative accounts or modifying existing ones to ensure continued access even if initial entry points are patched. The exploitation vector is remote via HTTP POST requests, making it accessible over a network where valid credentials have been obtained through phishing, credential stuffing, or other authentication bypass techniques.
To mitigate this vulnerability, developers must implement strict server-side authorization checks within the addSysUserGroup handler and related endpoints in SysUserController. It is essential to verify that the current session's user context holds the necessary administrative privileges before executing any logic that modifies group memberships for other users. Additionally, implementing role-based access control frameworks with explicit allow-lists for each endpoint can prevent such oversights. Regular security code reviews focusing on authentication and authorization flows are recommended to identify similar gaps in other parts of the application. Upgrading to a patched version of JeecgBoot where this issue has been resolved is also critical if available, alongside enforcing principle of least privilege across all user roles to limit the blast radius should such an exploit occur.