{"schemaVersion":3,"id":"CVE-2026-108638","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.","dates":{"published":"2026-10-10T21:49:30.589Z","modified":"2026-10-14T02:34:19.089Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00238,"percentile":0.1403,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-11T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00238,"percentile":0.1403}],"last30":[{"date":"2026-10-11T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00238,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00238,"percentile":0.1403}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ANKESKASTY_CVE-REQUEST-POC","name":"Cve Request Poc","source":"github","url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_ocr_record_edit.py","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"jeecgboot","product":"jeecgboot","name":"JeecgBoot","label":"jeecgboot","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.9.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.9.5","eol":null,"hubHref":"/vendor/jeecgboot/jeecgboot"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal.py","label":"github.com/AnkesKasty/…","hostname":"github.com","tags":["Exploit"]},{"url":"https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L829-L844","label":"github.com/jeecgboot/…","hostname":"github.com","tags":["Technical Description"]},{"url":"https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-deletegroupuser","label":"www.vulncheck.com/advisories/…","hostname":"www.vulncheck.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-10T21:49:30.589Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-14T02:34:19.089Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:59:47.445Z","stale":false,"partial":false}}