Jeecgboot vulnerabilities, page 5

113 vulnerabilities

Known vulnerabilities in Jeecgboot products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

5.3MediumCVE-2026-108640jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryByIdJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.EPSS0.24%5.3MediumCVE-2026-108637jeecgbootJeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.EPSS0.24%5.4MediumCVE-2026-108611jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library.EPSS0.27%7.1HighCVE-2026-108661jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenantJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.EPSS0.21%5.3MediumCVE-2026-108650jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSetJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.EPSS0.24%5.3MediumCVE-2026-108670jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experimentJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.EPSS0.19%5.4MediumCVE-2026-108613jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/app/release EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links.EPSS0.27%5.3MediumCVE-2026-108656jeecgbootJeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.EPSS0.19%5.3MediumCVE-2026-108674jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /openapi/queryByIdJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.EPSS0.19%5.4MediumCVE-2026-108884jeecgbootJeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.EPSS0.21%5.3MediumCVE-2026-108680jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncementJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.EPSS0.19%5.3MediumCVE-2026-108869jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncementJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.EPSS0.21%5.4MediumCVE-2026-108631jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/deleteJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.EPSS0.27%5.4MediumCVE-2026-108634jeecgbootJeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.EPSS0.27%5.3MediumCVE-2026-108642jeecgbootJeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/editJeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.EPSS0.24%5.3MediumCVE-2026-108627jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule EndpointJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.EPSS0.24%5.3MediumCVE-2026-108866jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuthsJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts.EPSS0.19%5.4MediumCVE-2026-108870jeecgbootJeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/dataruleJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level filters to widen readable records or altering filtering for other roles.EPSS0.17%5.3MediumCVE-2026-108873jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfoJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads without ownership or tenant checks.EPSS0.19%5.3MediumCVE-2026-108665jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/editJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.EPSS0.19%