CVE-2025-10981: Jeecg Boot Authorization Bypass Vulnerability

CVE-2025-10981 Overview

CVE-2025-10981 is an improper authorization vulnerability in JeecgBoot versions up to 3.8.2. The flaw resides in the /sys/tenant/exportXls endpoint, where insufficient authorization checks allow authenticated low-privileged users to invoke functionality they should not access. Attackers can trigger the vulnerability remotely over the network without user interaction. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-266: Incorrect Privilege Assignment.

Critical Impact
Authenticated attackers can invoke the tenant export function without proper authorization, enabling unauthorized retrieval of tenant data from affected JeecgBoot deployments.

Affected Products

JeecgBoot versions up to and including 3.8.2
Deployments exposing /sys/tenant/exportXls to authenticated users
Multi-tenant environments built on jeecg:jeecg_boot

Discovery Timeline

2025-09-26 - CVE-2025-10981 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10981

Vulnerability Analysis

JeecgBoot is a low-code development platform written in Java that provides multi-tenant capabilities through its sys/tenant controller. The /sys/tenant/exportXls endpoint generates an Excel export of tenant records but fails to enforce sufficient authorization before returning data. Any authenticated user with low privileges can call the endpoint and receive tenant information intended for administrative roles.

The attack requires network access to the JeecgBoot instance and valid low-privilege credentials. No user interaction is needed, and the exploit is publicly documented. Because JeecgBoot is frequently used as a backend framework for internal business applications, exposed tenant data can include organization names, contact fields, and account identifiers useful for follow-on attacks.

According to the current EPSS forecast, in-the-wild exploitation probability remains low, but public disclosure without a vendor patch elevates operational risk.

Root Cause

The root cause is missing or insufficient authorization enforcement on the exportXls handler within the tenant controller. Authentication alone is treated as sufficient, and role or permission checks required for administrative export operations are absent. This aligns with CWE-266, where a subject retains or acquires privileges it should not hold.

Attack Vector

The attack vector is remote and network-based. An attacker authenticates with any low-privilege account, then issues an HTTP request to /sys/tenant/exportXls. The server processes the request and returns an XLS file containing tenant records. See the VulDB Entry #325852 and the VulDB CTI Report #325852 for additional technical context.

No verified exploit code is republished here. Refer to the vendor-independent technical disclosure blog post for the disclosed request pattern.

Detection Methods for CVE-2025-10981

Indicators of Compromise

HTTP requests to /sys/tenant/exportXls originating from non-administrative user sessions
Unexpected downloads of .xls files from JeecgBoot hosts by low-privilege accounts
Repeated exportXls requests from a single session or IP indicating scripted enumeration

Detection Strategies

Correlate authenticated user roles against endpoints accessed to flag privilege mismatches on /sys/tenant/* routes
Alert on any HTTP 200 response to /sys/tenant/exportXls where the caller lacks a tenant-admin role claim
Baseline normal export volumes per user and alert on deviations

Monitoring Recommendations

Enable verbose access logging on the JeecgBoot application server and forward logs to a centralized analytics platform
Monitor egress traffic for outbound transfer of exported tenant files to untrusted destinations
Review authentication logs for newly created or dormant low-privilege accounts issuing sensitive API calls

How to Mitigate CVE-2025-10981

Immediate Actions Required

Restrict network access to JeecgBoot administrative endpoints, including /sys/tenant/*, using a reverse proxy or WAF allowlist
Disable or remove low-privilege accounts that do not require access to the JeecgBoot administrative UI
Audit existing tenant exports and rotate any credentials or identifiers exposed through the endpoint

Patch Information

At the time of publication, the vendor has not released a fix and did not respond to the disclosure. Track the VulDB Submission #653341 and the JeecgBoot project repository for updates. Upgrade to a patched release as soon as one becomes available.

Workarounds

Add an authorization filter or interceptor in front of /sys/tenant/exportXls that verifies the caller holds a tenant-admin role before processing the request
Block the endpoint at the reverse proxy for all source addresses outside the administrative management network
Enforce short-lived sessions and step-up authentication for any account authorized to reach tenant management endpoints

bash

# Example Nginx block to restrict tenant export endpoint to admin subnet
location = /sys/tenant/exportXls {
    allow 10.10.20.0/24;   # admin management network
    deny all;
    proxy_pass http://jeecgboot_backend;
}