JeecgBoot: Missing authorization in tenant administrator application approval
Summary
JeecgBoot up to and including 3.9.5 has a missing authorization check in the passApply handler of the tenant controller (CWE-862). Any authenticated user can approve pending tenant administrator applications and gain tenant administrator pack permissions in any tenant. The attacker needs network access to the application and a valid low-privilege account, with no user interaction required.
Affected
- JeecgBoot up to and including 3.9.5 (per CVE record; 3.9.5 is the latest release)
Fixed in
Unknown. No vendor advisory or fixed release was found. A commit referenced by OSV as a fix could not be verified.
Workaround
- Restrict access to /sys/tenant/ endpoints at the reverse proxy or WAF to administrators only
- Disable open self-registration and tenant applications if they are not needed
- Log and alert on calls to /sys/tenant/passApply
Exploitation
- A public proof-of-concept script exists in a public GitHub repository (not reviewed).
- No known exploitation in the wild in the sources reviewed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00231.
Our recommendation
- Treat as high priority for any internet-facing JeecgBoot instance.
- Confirm the installed version and check the JeecgBoot repository for a fix.
- Apply the proxy restrictions above until a fix is confirmed.
- Review existing tenant administrator grants and pending applications for unexpected changes.
- Patch or mitigate related tenant endpoint issues together with this one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: JeecgBoot missing authorization via /sys/tenant/passApply www.vulncheck.com
- OSV: CVE-2026-108657 osv.dev
- JeecgBoot SysTenantController.java (referenced vulnerable code) github.com
- Public proof-of-concept script (GitHub) github.com
- OpenCVE: CVE-2026-108657 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:03.
Original description (NVD)
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
NVD references (3)
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_ten…
- https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-…
- https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-passapply
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.