CVE-2026-108883: Kerentanan Otorisasi JeecgBoot di Konfigurasi Integrasi

CVE ID	CVE-2026-108883
Severity	HIGH — CVSS CVSS V4.0 7.1
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE	CWE-862 Missing Authorization
Produk	jeecgboot / JeecgBoot — 0 (affected)
Dipublikasikan	2026-10-11

Ringkasan Cepat

• CVE-2026-108883 adalah kerentanan missing authorization (CWE-862) pada handler /sys/thirdApp/editThirdAppConfig di JeecgBoot through 3.9.5.
• Pengguna terautentikasi berhak rendah dapat mengganti client id, client secret, agent id, dan corp id integrasi DingTalk, WeCom, atau Feishu.
• Severity HIGH 7.1 (CVSS v4.0); vektor menunjukkan dampak integritas tinggi tanpa dampak kerahasiaan dan ketersediaan yang disebut, serta scope tidak berubah.

Ringkasan Kerentanan

CVE-2026-108883 adalah kerentanan missing authorization dengan CWE-862 pada handler editThirdAppConfig. Deskripsi resmi menyebut JeecgBoot through 3.9.5 memiliki kelemahan otorisasi pada endpoint /sys/thirdApp/editThirdAppConfig. Akibatnya, pengguna yang sudah terautentikasi dapat mengubah konfigurasi aplikasi pihak ketiga.

Judul CNA untuk CVE ini adalah JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig. Severity yang diberikan adalah HIGH 7.1 dengan vektor CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Tanggal publikasi: 2026-10-11T14:33:43.938Z.

Dampak Teknis

Karena otorisasi tidak diperiksa, aktor dengan akun terautentikasi berhak rendah dapat mengganti nilai konfigurasi integrasi pihak ketiga. Deskripsi resmi menyebut nilai yang dapat diganti mencakup client id, client secret, agent id, dan corp id untuk integrasi DingTalk, WeCom, atau Feishu.

Dampak yang disebut adalah pengalihan sinkronisasi direktori dan pesan ke aplikasi yang dikendalikan penyerang, atau membuat integrasi tersebut rusak. Pada vektor CVSS v4.0, nilai VI:H menunjukkan dampak integritas tinggi, sementara VC:N, VA:N, SC:N, SI:N, dan SA:N menunjukkan tidak ada dampak yang disebut pada kerahasiaan, ketersediaan, dan scope.

Produk Terdampak

Judul CNA menyatakan produk terdampak adalah JeecgBoot through 3.9.5. Data produk pada CVE mencantumkan vendor jeecgboot, produk JeecgBoot, dengan entri versi 0 (affected).

Untuk pertahanan, fokuskan pemeriksaan pada endpoint /sys/thirdApp/editThirdAppConfig dan perubahan konfigurasi integrasi. Audit log akses endpoint, riwayat perubahan konfigurasi, serta bandingkan nilai integrasi DingTalk, WeCom, dan Feishu dengan baseline yang disetujui.

Konteks dan Prioritas

Kerentanan ini memiliki referensi publik, termasuk tautan PoC di GitHub, kode sumber ThirdAppController.java pada baris yang dirujuk, dan advisori VulnCheck. Adanya referensi publik dapat meningkatkan urgensi untuk memastikan kontrol otorisasi dan pemantauan berjalan.

Prioritas defensif: pastikan endpoint tidak dapat diakses oleh peran rendah, rotasi kredensial integrasi bila ada perubahan tidak sah, dan pantau patch dari vendor JeecgBoot. Referensi: https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_thirdapp_edit_config_post.py, https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdAppController.java#L412-L438, https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-thirdapp-editthirdappconfig.

Mitigasi dan Perbaikan

• Terapkan patch atau versi perbaikan dari vendor JeecgBoot segera setelah tersedia; pantau repositori resmi dan advisori keamanan karena fakta ini tidak menyebut nomor versi perbaikan.
• Batasi akses ke endpoint <code>/sys/thirdApp/editThirdAppConfig</code> hanya untuk peran administrator integrasi; pastikan pemeriksaan otorisasi dilakukan di sisi server, bukan hanya menyembunyikan menu.
• Audit dan rotasi kredensial integrasi DingTalk, WeCom, dan Feishu (client id, client secret, agent id, corp id) jika ada indikasi perubahan tidak sah atau akses mencurigakan.
• Aktifkan pemantauan log dan alert untuk setiap perubahan konfigurasi third-party app; bandingkan dengan baseline dan tindak lanjuti modifikasi di luar jam atau di luar perubahan yang disetujui.
• Terapkan prinsip least privilege pada akun terautentikasi dan tinjau integrasi direktori/pesan agar dampak penyalahgunaan otorisasi dapat dibatasi.

Referensi Resmi

• CVE-2026-108883 — CVE Program (cve.org)
• https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_thirdapp_edit_config_post.py
• https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdAppController.java#L412-L438
• https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-thirdapp-editthirdappconfig

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-108883?

Kerentanan missing authorization (CWE-862) pada handler editThirdAppConfig di JeecgBoot through 3.9.5. Deskripsi resmi menyebut pengguna terautentikasi dapat mengubah konfigurasi aplikasi pihak ketiga.

Seberapa parah kerentanan ini?

Severity HIGH 7.1 (CVSS v4.0) dengan vektor CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Dampak integritas tinggi; vektor tidak menyebut dampak kerahasiaan atau ketersediaan.

Apakah penyerang perlu memiliki akun?

Ya. Kerentanan ini membutuhkan pengguna yang sudah terautentikasi, tetapi pengguna berhak rendah dapat menjadi aktor karena otorisasi tidak diperiksa.

Produk apa yang terdampak?

JeecgBoot through 3.9.5 menurut judul CNA. Data produk CVE mencantumkan vendor jeecgboot, produk JeecgBoot, versi 0 (affected).

Apakah ada bukti konsep publik?

Referensi CVE mencantumkan tautan PoC di GitHub. Artikel ini tidak memuat langkah eksploitasi dan berfokus pada mitigasi defensif.

Apa yang perlu dipantau?

Perubahan tidak sah pada client id, client secret, agent id, atau corp id integrasi DingTalk, WeCom, Feishu, serta gangguan sinkronisasi direktori atau pengiriman pesan. Audit log endpoint editThirdAppConfig dan konfigurasi integrasi.

English Version — CVE-2026-108883: JeecgBoot Authorization Vulnerability in Integration Configuration

Quick Summary

• CVE-2026-108883 is a missing authorization vulnerability (CWE-862) in the /sys/thirdApp/editThirdAppConfig handler in JeecgBoot through 3.9.5.
• A low-privileged authenticated user can replace the client id, client secret, agent id, and corp id of a DingTalk, WeCom, or Feishu integration.
• Severity HIGH 7.1 (CVSS v4.0); the vector indicates a high integrity impact with no stated confidentiality or availability impact, and an unchanged scope.

Vulnerability Overview

CVE-2026-108883 is a missing authorization vulnerability, CWE-862, in the editThirdAppConfig handler. The official description states that JeecgBoot through 3.9.5 has an authorization weakness in the /sys/thirdApp/editThirdAppConfig endpoint. As a result, authenticated users can modify third-party application configuration.

The CNA title for this CVE is JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig. The assigned severity is HIGH 7.1 with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Publication date: 2026-10-11T14:33:43.938Z.

Technical Impact

Because authorization is not checked, an actor with a low-privileged authenticated account can replace third-party integration configuration values. The official description states that the values that can be replaced include client id, client secret, agent id, and corp id for DingTalk, WeCom, or Feishu integrations.

The stated impact is the redirection of directory and message synchronization to an application controlled by the attacker, or rendering those integrations broken. In the CVSS v4.0 vector, the value VI:H indicates a high integrity impact, while VC:N, VA:N, SC:N, SI:N, and SA:N indicate no stated impact on confidentiality, availability, or scope.

Affected Products

The CNA title states that the affected product is JeecgBoot through 3.9.5. The CVE product data lists the vendor jeecgboot, the product JeecgBoot, with the version entry 0 (affected).

For defensive purposes, focus your checks on the /sys/thirdApp/editThirdAppConfig endpoint and on integration configuration changes. Audit endpoint access logs and configuration change history, and compare the DingTalk, WeCom, and Feishu integration values against the approved baseline.

Context and Priority

This vulnerability has public references, including a PoC link on GitHub, the ThirdAppController.java source code at the referenced lines, and a VulnCheck advisory. The existence of public references can increase the urgency of ensuring that authorization controls and monitoring are in place.

Defensive priorities: ensure the endpoint cannot be reached by low-privileged roles, rotate integration credentials if unauthorized changes are found, and monitor for patches from the JeecgBoot vendor. References: https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_thirdapp_edit_config_post.py, https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdAppController.java#L412-L438, https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-thirdapp-editthirdappconfig.

Mitigation

• Apply the patch or fixed version from the JeecgBoot vendor as soon as it becomes available; monitor the official repository and security advisories, since this fact does not state a fixed version number.
• Restrict access to the <code>/sys/thirdApp/editThirdAppConfig</code> endpoint to integration administrator roles only; ensure that authorization checks are performed server-side, not merely by hiding menus.
• Audit and rotate DingTalk, WeCom, and Feishu integration credentials (client id, client secret, agent id, corp id) if there is any indication of unauthorized changes or suspicious access.
• Enable log monitoring and alerting for every change to third-party app configuration; compare against the baseline and follow up on modifications made outside business hours or outside approved changes.
• Apply the principle of least privilege to authenticated accounts and review directory and messaging integrations so that the impact of authorization abuse can be contained.

FAQ (English)

What is CVE-2026-108883?

A missing authorization vulnerability (CWE-862) in the editThirdAppConfig handler in JeecgBoot through 3.9.5. The official description states that authenticated users can modify third-party application configuration.

How severe is this vulnerability?

Severity HIGH 7.1 (CVSS v4.0) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. High integrity impact; the vector states no confidentiality or availability impact.

Does an attacker need to have an account?

Yes. This vulnerability requires an authenticated user, but a low-privileged user can act as the actor because authorization is not checked.

Which products are affected?

JeecgBoot through 3.9.5 according to the CNA title. The CVE product data lists vendor jeecgboot, product JeecgBoot, version 0 (affected).

Is there public proof-of-concept evidence?

The CVE references list a PoC link on GitHub. This article does not include exploitation steps and focuses on defensive mitigation.

What should be monitored?

Unauthorized changes to the client id, client secret, agent id, or corp id of DingTalk, WeCom, or Feishu integrations, as well as disruption of directory synchronization or message delivery. Audit logs for the editThirdAppConfig endpoint and the integration configuration.