CVE-2026-108882 | JeecgBoot up to 3.9.5 SysPositionController poc_c324_sys_position_remove_user.py removeUserPosition userIds/positionId missing authentication

October 11, 2026 Yanac

A vulnerability classified as problematic was found in JeecgBoot up to 3.9.5. This affects the function removeUserPosition of the file poc_c324_sys_position_remove_user.py of the component SysPositionController. Executing a manipulation of the argument userIds/positionId can lead to missing authentication.

This vulnerability is registered as CVE-2026-108882. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More