CVE-2026-108657

Summary

JeecgBoot 3.9.5 contains a missing authorization vulnerability in the SysTenantController that allows any authenticated user to approve tenant administrator applications, granting them administrative permissions in any tenant. This creates a privilege escalation path where attackers can gain full tenant admin rights without proper authorization checks.

Exploitability

The exploit is straightforward requiring only authenticated access to call the passApply endpoint, with no additional preconditions needed beyond having an account in the system.

Blast radius

The impact could be significant as attackers could gain administrative control over any tenant's user management and configuration, potentially leading to data compromise or lateral movement across tenant boundaries.

Detection

Monitor for unauthorized PUT requests to /sys/tenant/passApply endpoint with elevated user permissions, particularly when these requests occur outside normal business hours or from unusual IP addresses.

Prioritized remediation

Upgrade to JeecgBoot 3.9.6 or later to receive the authorization fix for the SysTenantController passApply handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.