Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-108638: JeecgBoot allows low‑privilege users to delete any group member
CVE-2026-108638 · published 25 days ago
Summary
In JeecgBoot versions up to 3.9.5, a user who is logged in but does not have admin rights can send a request to remove any user from any group, even groups they do not control. This can let an attacker strip administrators of their group memberships, potentially disrupting management functions. Apply the vendor’s security update or restrict access to the deleteGroupUser endpoint until the patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jeecgboot | jeecgboot | <= 3.9.5 |
Original advisory text
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
References
- https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorizati... Vendor Advisory
- https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c8... Third Party Advisory
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0... Exploit
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1086... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-108638 Vendor Advisory
- https://github.com/jeecgboot/JeecgBoot Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-862Missing Authorization
Timeline
Published10 Oct 2026
Updated4 Nov 2026
First seen10 Oct 2026
Track software like this
Free during beta