CVE-2026-108638mediumCWE-862

CVE-2026-108638: fallo de gravedad media en JeecgBoot

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear JeecgBoot

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.2%
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
jeecgboot · JeecgBoot
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — JeecgBoot

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-58377HIGHJeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret KeysEPSS 0.4%CVE-2026-108623HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatchEPSS 0.3%CVE-2026-108648HIGHJeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode EndpointEPSS 0.3%CVE-2026-108639MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}EPSS 0.3%CVE-2026-112017HIGHJeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline BypassEPSS 0.3%CVE-2026-108671HIGHJeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryByIdEPSS 0.3%