CVE-2026-108638 — JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler…
Published: 2026-10-10 · CVSS: 5.3 · CVSS 4.0
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7