# CVE-2026-108657: JeecgBoot missing authorization in tenant pack approval

Source: https://junglewise.ai/threats/cve-2026-108657-jeecgboot-through-3-9-5-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108657 · Severity: high · CVSS 8.1 · Published 2026-10-10

JeecgBoot is a low-code application development framework that manages tenant organizations and their administrative access packages. A missing authorization check in the tenant pack approval endpoint allows any authenticated user to approve administrator privilege applications for any tenant, granting them unrestricted admin-level permissions across the platform.

## Quick answers

**Is CVE-2026-108657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108657 being exploited in the wild.

**How severe is CVE-2026-108657?** High severity, with a CVSS score of 8.1, published 10 October 2026.

**Which products and versions are affected?** JeecgBoot through 3.9.5.

**Is there a fix for CVE-2026-108657?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108657 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108657?** Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the SysTenantController.passApply handler (PUT /sys/tenant/passApply), which lacks authorization checks to verify the caller administers the target tenant before approving pack user applications. An authenticated attacker can enumerate pending administrator applications via the unprotected getTenantPackApplyUsers endpoint and approve any application, gaining tenant pack user privileges without tenant admin authorization. The vulnerability affects the tenant pack provisioning flow where any authenticated user can call addTenantPackUser after approving an application status.

## Affected products

- JeecgBoot through 3.9.5

## Timeline

- 2026-10-10: disclosed

## References

- [https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_ownership_and_pack_approval.py](https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_ownership_and_pack_approval.py)
- [https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java](https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java)

## Related threats

- [JeecgBoot missing authorization in SysPositionController](https://junglewise.ai/threats/cve-2026-108620-jeecgboot-through-3-9-5-contains-a-missing-authorization)