CVE-2026-108656 jeecgboot CVE debrief

Who should care

Defenders and administrators of JeecgBoot systems, particularly those with low-privileged users, should assess exposure and implement compensating controls to prevent unauthorized access to sensitive information.

Why it matters

CVE-2026-108656 is a missing authorization vulnerability in JeecgBoot through 3.9.5, allowing authenticated users to read tenant administrator applications. Defenders should prioritize verifying exposure, implementing compensating controls, and reviewing authentication and authorization mechanisms.

• Potential unauthorized access to sensitive information
• Possible data exposure for pending applicants
• Need for verification of system configurations and inventory
• Potential for lateral movement or escalation of privileges

Technical summary

The vulnerability exists in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint of JeecgBoot through 3.9.5, allowing any authenticated user to read tenant administrator applications by iterating the tenantId parameter. This enables low-privileged attackers to retrieve pending applicants' usernames, real names, phone numbers, and departments for any tenant. Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows unauthorized access to sensitive information.

Recommended defensive actions

• Verify exposure by checking system configurations and inventory
• Implement compensating controls, such as monitoring and access restrictions
• Review and update authentication and authorization mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in JeecgBoot through 3.9.5, specifically in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint. Additional verification is required to determine the full scope of affected systems and potential impact. Defenders should verify exposure, review system configurations and inventory, and implement compensating controls to prevent unauthorized access to sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.