CVE-2026-108621

Received Received - Intake

JeecgBoot Missing Authorization in SysPositionController

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit to alter position names, codes, and ranks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108621

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysPositionController edit handler. This flaw allows any authenticated user, even with low privileges, to modify organizational positions. Attackers can retrieve position IDs from an unprotected list endpoint and then send PUT or POST requests to /sys/position/edit to change position names, codes, and ranks.

Detection Guidance

Check for unauthorized PUT or POST requests to /sys/position/edit endpoint. Monitor logs for requests modifying position names, codes, or ranks by low-privileged users. Verify if any user can access the unguarded list endpoint to obtain position IDs.

Impact Analysis

Low-privileged attackers could manipulate organizational structures, potentially leading to unauthorized changes in roles, permissions, or hierarchies. This could disrupt business operations, cause confusion in reporting lines, or enable further attacks by altering position-based access controls.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's principle of least privilege or HIPAA's access control safeguards. Unauthorized modifications to organizational positions may lead to non-compliance, potential fines, or audit failures.

Mitigation Strategies

Apply the latest patch for JeecgBoot version 3.9.5 or later. Restrict access to /sys/position/edit endpoint to authorized users only. Implement proper authorization checks for all endpoints handling position data.

Hi! I’m here to help you understand CVE-2026-108621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70