JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication

published 2025-12-19 10 mo ago modified 2026-10-13 26 d ago also EUVD-2025-204433

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Multi-Tenant Management Module. Performing manipulation of the argument ID results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee. It is recommended to apply a patch to fix this issue.

Patch / fix

links 1

github.com/jeecgboot/JeecgBoot@e1c8f00 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 10 mo ago (2025-12-19)

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/jeecgboot/JeecgBoot/issues/9196 referenced PoC, tagged "exploit" by a source, unverified
vuldb.com https://vuldb.com/?submit.715742 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

n/a JeecgBoot

Classification

Weakness

CWE-287 Improper Authentication

References

github.com /jeecgboot/JeecgBoot/commit/e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2
patch
github.com /jeecgboot/JeecgBoot/issues/9196
exploit, issue-tracking, third-party-advisory
vuldb.com /?submit.715742
third-party-advisory, exploit, vdb-entry
vuldb.com /?id.337432
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.337432
signature, permissions-required, third-party-advisory, vdb-entry

Sources

CVE List CVE-2025-14908
NVD CVE-2025-14908

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary