CVE-2026-108661 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot installations, especially those with tenant ownership management, should assess exposure and prioritize remediation. They should review compensating controls for exposed systems while remediation is scheduled and verified. Defenders should also track exceptions, retest remediated assets, and close the item only after evidence is documented

Why it matters

CVE-2026-108661 is a high-severity vulnerability in JeecgBoot that allows authenticated users to transfer tenant ownership, potentially leading to privilege escalation and unauthorized access.

• Authenticated users can transfer tenant ownership without proper authorization
• Low-privileged attackers can exploit this to gain elevated privileges
• Tenant ownership changes can be made without legitimate owner's consent
• Verification of affected versions and remediation steps is necessary

Technical summary

The vulnerability exists in the SysTenantController class, specifically in the changeOwenUserTenant method. This method allows any authenticated user to transfer tenant ownership by supplying userId and tenantId parameters. The vulnerability allows authenticated users to transfer tenant ownership without proper authorization, potentially leading to privilege escalation and unauthorized access. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where tenant ownership management is critical. Verification of affected versions and remediation steps is necessary to prevent potential misuse

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where tenant ownership management is critical.

Recommended defensive actions

• Verify and remediate the vulnerability in JeecgBoot installations
• Restrict access to tenant ownership management
• Monitor for suspicious tenant ownership changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Additional verification is needed to confirm affected versions and remediation steps. The vulnerability allows authenticated users to transfer tenant ownership without proper authorization, potentially leading to privilege escalation and unauthorized access. Defenders should verify and remediate this vulnerability, especially in systems where tenant ownership management is critical. The CVE Program record and NVD detail page offer source-provided CVE metadata and a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.