# CVE-2026-108881: JeecgBoot missing authorization in getTenantPackInfo

Source: https://junglewise.ai/threats/cve-2026-108881-jeecgboot-through-3-9-5-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108881 · Severity: medium · CVSS 4.3 · Published 2026-10-11

JeecgBoot is an application development platform used to build web applications. A flaw in the getTenantPackInfo handler allows any authenticated user to retrieve administrator account details (usernames, real names, phone numbers) from other tenants by making a simple request. This could enable account takeover or targeted social engineering attacks against organizational administrators.

Technologies: [JeecgBoot](https://junglewise.ai/threats/technologies/jeecgboot). Vendors: [JeecgBoot](https://junglewise.ai/threats/vendors/jeecgboot).

## Quick answers

**Is CVE-2026-108881 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108881 being exploited in the wild.

**How severe is CVE-2026-108881?** Medium severity, with a CVSS score of 4.3, published 11 October 2026.

**Which products and versions are affected?** JeecgBoot through 3.9.5.

**Is there a fix for CVE-2026-108881?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108881 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108881?** Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The getTenantPackInfo endpoint in SysTenantController lacks authorization checks and directly returns sensitive administrator pack membership information based on caller-supplied tenantId and packCode parameters. An authenticated attacker can enumerate fixed pack codes (superAdmin, accountAdmin, appAdmin) across tenants to disclose administrator identity details including username, realname, phone, avatar, and department names without permission.

## Affected products

- JeecgBoot JeecgBoot through 3.9.5

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_pack_members.py](https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_pack_members.py)
- [https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java](https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java)

## Related threats

- [JeecgBoot SQL injection in Table Dictionary API](https://junglewise.ai/threats/cve-2026-124555-a-weakness-has-been-identified-in-jeecgboot-3-9-5-this)
- [JeecgBoot SQL injection in JimuBI drag chart endpoint](https://junglewise.ai/threats/cve-2026-124554-a-security-flaw-has-been-discovered-in-jeecgboot-3-9-5-this)
- [JeecgBoot SQL injection in SqlInjectionUtil keyword bypass](https://junglewise.ai/threats/cve-2026-112017-jeecgboot-before-3-9-5-contains-an-sql-injection-vulnerability)
- [JeecgBoot missing authorization in getUserDetailByUserId](https://junglewise.ai/threats/cve-2026-108891-jeecgboot-through-3-9-5-contains-a-missing-authorization)
- [JeecgBoot authorization bypass in SysDepartRoleController exportXls](https://junglewise.ai/threats/cve-2026-108888-jeecgboot-through-3-9-5-contains-a-missing-authorization)