CVE-2026-108656 in JeecgBoot
Resumen
por MITRE • 2026-10-11
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.