Summary
JeecgBoot through version 3.9.5 contains a missing authorization flaw in the tenant administrator application approval workflow. Any authenticated user may be able to approve a pending application and obtain tenant administrator pack permissions in a tenant where the workflow is exposed.
JeecgBoot through version 3.9.5 contains a missing authorization flaw in the tenant administrator application approval workflow. Any authenticated user may be able to approve a pending application and obtain tenant administrator pack permissions in a tenant where the workflow is exposed.
Affected context
The vulnerability occurs in JeecgBoot deployments through 3.9.5 where the SysTenantController passApply handler processes tenant administrator applications without adequately verifying that the requesting user has approval authority. Risk is greatest when authenticated users can submit tenant applications and reach the approval workflow exposed through the tenant management API.
The vulnerability occurs in JeecgBoot deployments through 3.9.5 where the SysTenantController passApply handler processes tenant administrator applications without adequately verifying that the requesting user has approval authority. Risk is greatest when authenticated users can submit tenant applications and reach the approval workflow exposed through the tenant management API.
Exploit preconditions
- Attack surface: Authenticated tenant-management API endpoints
- Required access: A valid user account with access to the tenant application workflow
- Trigger point: Processing of a pending application by the
passApplyhandler - Why exploitation is possible: The approval operation does not sufficiently enforce the required administrative authorization before changing tenant permissions
- Attack surface: Authenticated tenant-management API endpoints
- Required access: A valid user account with access to the tenant application workflow
- Trigger point: Processing of a pending application by the
passApplyhandler - Why exploitation is possible: The approval operation does not sufficiently enforce the required administrative authorization before changing tenant permissions
Why this happens
The underlying bug is an authorization decision failure in a state-changing controller action. The application accepts an authenticated identity as sufficient to invoke an approval operation, without reliably checking whether that identity is authorized to approve tenant administrator requests. This behavior maps to CWE-862, Missing Authorization, because access control enforcement is absent or insufficient for a protected function.
The underlying bug is an authorization decision failure in a state-changing controller action. The application accepts an authenticated identity as sufficient to invoke an approval operation, without reliably checking whether that identity is authorized to approve tenant administrator requests. This behavior maps to CWE-862, Missing Authorization, because access control enforcement is absent or insufficient for a protected function.
Potential impact
- An authenticated user may gain tenant administrator pack permissions
- Unauthorized users could modify tenant-level settings or memberships
- Tenant data and administrative workflows could be exposed to manipulation
- Compromised tenant privileges could support further abuse within the application
- An authenticated user may gain tenant administrator pack permissions
- Unauthorized users could modify tenant-level settings or memberships
- Tenant data and administrative workflows could be exposed to manipulation
- Compromised tenant privileges could support further abuse within the application
General mitigation guidance
Mitigation generally centers on enforcing authorization at every protected
state-changing operation rather than relying on authentication alone.
Common defensive patterns include:
- Applying server-side role and tenant-scope checks before approving applications
- Ensuring only explicitly authorized tenant administrators or platform operators can approve requests
- Denying access by default when the caller's role, tenant, or approval scope is absent
- Rechecking authorization for each workflow transition, including direct API requests
- Using least-privilege roles and separating application submission from approval responsibilities
- Auditing approval events and alerting on unexpected role or permission changes
Mitigation generally centers on enforcing authorization at every protected
state-changing operation rather than relying on authentication alone.
Common defensive patterns include:
- Applying server-side role and tenant-scope checks before approving applications
- Ensuring only explicitly authorized tenant administrators or platform operators can approve requests
- Denying access by default when the caller's role, tenant, or approval scope is absent
- Rechecking authorization for each workflow transition, including direct API requests
- Using least-privilege roles and separating application submission from approval responsibilities
- Auditing approval events and alerting on unexpected role or permission changes
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying state-changing handlers without nearby authorization checks
- Code review signals such as controller methods that authenticate users but do not verify roles, tenant scope, or approval authority
- Integration tests covering unauthorized approval attempts and cross-tenant access
- Policy enforcement requiring explicit authorization annotations or centralized access-control middleware
- Audit-log reviews for tenant administrator grants performed by non-administrative accounts
Automated security review tools may help identify missing checks, but endpoint-level authorization tests remain important.
Organizations can look for this class of issue through:
- Static analysis rules identifying state-changing handlers without nearby authorization checks
- Code review signals such as controller methods that authenticate users but do not verify roles, tenant scope, or approval authority
- Integration tests covering unauthorized approval attempts and cross-tenant access
- Policy enforcement requiring explicit authorization annotations or centralized access-control middleware
- Audit-log reviews for tenant administrator grants performed by non-administrative accounts
Automated security review tools may help identify missing checks, but endpoint-level authorization tests remain important.
