JeecgBoot: 25 Missing Authorization Vulnerabilities Disclosed Together in v3.9.5
A batch of 25 medium-severity authorization flaws in JeecgBoot v3.9.5 allows authenticated users to access sensitive data and functions.
Key findings
- 25 missing authorization vulnerabilities disclosed in JeecgBoot v3.9.5.
- Vulnerabilities span user management, system announcements, AI features, and tenant administration.
- Low-privileged authenticated users can access or manipulate data beyond their scope.
- All affected versions are through 3.9.5; update recommended.
- Coordinated disclosure highlights systemic authorization flaws.
On October 10-11, 2026, a batch of 25 medium-severity vulnerabilities was disclosed in JeecgBoot through version 3.9.5. These vulnerabilities primarily stem from missing authorization checks, allowing authenticated users with low privileges to access or manipulate data and functionalities beyond their intended scope. The disclosures highlight a systemic issue with authorization enforcement across various modules of the JeecgBoot platform, including user management, system announcements, AI features, and tenant administration. The collective impact of these flaws could allow attackers to escalate privileges, exfiltrate sensitive data, or disrupt system operations.
The vulnerabilities can be broadly categorized by the affected modules and functionalities:
User and Department Management
Several vulnerabilities impact the management of users and departments. CVE-2026-108891, CVE-2026-108886, and CVE-2026-108872 allow low-privileged users to view or modify other users' details, account records, and department assignments, respectively. Unauthorized modification of department information and leadership is possible via CVE-2026-108873 and CVE-2026-108874. Additionally, CVE-2026-108875 permits arbitrary users to be added to or removed from user groups, while CVE-2026-108867 and CVE-2026-108868 enable the sending of forged system announcements. CVE-2026-108876 allows for the cancellation of user resignations.
Data Export and Configuration Manipulation
A significant number of CVEs involve unauthorized data exports and configuration modifications. Attackers can export department roles (CVE-2026-108888) and all comments (CVE-2026-108887) due to missing authorization in export handlers. Dictionaries for low-code applications can be modified via CVE-2026-108880. Third-party application configurations, such as those for DingTalk or WeCom, can be altered through CVE-2026-108883. Furthermore, message records (CVE-2026-108885) and message templates (CVE-2026-108884) can be deleted without proper authorization.
AI Features and Tenant Information Access
The batch also includes vulnerabilities affecting JeecgBoot's AI functionalities and tenant management. CVE-2026-108879 allows access to other users' AI chat variables, while CVE-2026-108878 permits reading any AI application configuration. Deletion of AI prompt templates is possible via CVE-2026-108877. Tenant-specific information, such as product pack membership, can be accessed by any authenticated user through CVE-2026-108881.
Role and Permission Management
Vulnerabilities related to role and permission management include CVE-2026-108871 and CVE-2026-108870, which allow low-privileged users to modify data rules for department roles and general roles, respectively. This could lead to widened access to data. Additionally, CVE-2026-108869 and CVE-2026-108866 allow unauthorized users to view other users' role assignments and complete permission sets, aiding in privilege escalation.
The disclosures, reported by Vypr Intelligence on October 10, 2026, emphasize that all affected versions are through 3.9.5. Users are strongly recommended to update to a patched version to mitigate these risks. The consistent theme across all 25 CVEs is the lack of proper authorization checks, enabling authenticated users to perform actions beyond their intended privileges.
This extensive batch of vulnerabilities underscores the importance of rigorous security testing and code review for authorization mechanisms in web applications. Users of JeecgBoot should prioritize updating their systems and review their access control policies to ensure that the principle of least privilege is strictly enforced. The coordinated disclosure of these flaws provides a clear roadmap for remediation efforts.