CVE-2026-108662 in JeecgBoot
Zusammenfassung
von MITRE • 11.10.2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.