HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108657 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy...

·Source: NIST NVD

Updated:

Executive Summary

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.

Analysis

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant. CVSS Score: 8.1. Published: 2026-10-10T22:16:41.923.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108657
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

NAB cuts 2,500 jobs citing "technological change"

National Australia Bank (NAB) is to axe 2,500 employees in its latest restructuring, equivalent to 6% of the workforce

Finextra
MEDIUMVulnerabilityNEW

Mynt IPO breaks records in Philippines

Philippines-based fintech Mynt has raised $967m from what is the country's biggest ever IPO.

Finextra
MEDIUMVulnerability

Ahold Delhaize: Cyberattack affects services across US and Europe

Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]

BleepingComputer