Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10977JeecgBoot deleteBatch improper authorization

Low 3.1

In plain English

A low-severity security flaw in JeecgBoot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	JeecgBoot	3.8.03.8.13.8.2

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-325848 | JeecgBoot deleteBatch improper authorization vdb-entry, technical-description
VDB-325848 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #653335 | jeecgboot JeecgBoot 3.8.2 broken function level authorization third-party-advisory
https://www.cnblogs.com/aibot/p/19063351 exploit