{"id":"CVE-2026-108638","state":"PUBLISHED","title":"JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser","description":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.","publishedAt":"2026-10-10T21:49:30.589Z","updatedAt":"2026-10-14T02:34:19.089Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["jeecgboot JeecgBoot"],"affected":[{"vendor":"jeecgboot","product":"JeecgBoot","packageURL":"pkg:github/jeecgboot/JeecgBoot","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.9.5","versionType":"custom"}],"repo":"https://github.com/jeecgboot/JeecgBoot"}],"references":["https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal.py","https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L829-L844","https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-deletegroupuser"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/108xxx/CVE-2026-108638.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-108638","state":"PUBLISHED","datePublished":"2026-10-10T21:49:30.589Z","dateUpdated":"2026-10-14T02:34:19.089Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-10T20:18:28.240Z"},"containers":{"cna":{"title":"JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser","descriptions":[{"lang":"en","value":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks."}],"affected":[{"vendor":"jeecgboot","product":"JeecgBoot","packageURL":"pkg:github/jeecgboot/JeecgBoot","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.9.5","versionType":"custom"}],"repo":"https://github.com/jeecgboot/JeecgBoot"}],"references":[{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal.py","tags":["exploit"],"name":"Researcher Proof of Concept"},{"url":"https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L829-L844","tags":["technical-description"],"name":"Vulnerable Code (v3.9.5)"},{"url":"https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-deletegroupuser","name":"VulnCheck Advisory: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-10T21:49:30.589Z"},"datePublic":"2026-10-10T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*","versionEndIncluding":"3.9.5"}]}]}],"credits":[{"lang":"en","value":"Yaqi Chao","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-14T02:34:10.744552Z","id":"CVE-2026-108638","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T02:34:19.089Z"}}]}}}