CVE-2025-15126 | JeecgBoot up to 3.9.0 getPositionUserList positionId improper authorization

A vulnerability marked as problematic has been reported in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization.

This vulnerability appears as CVE-2025-15126. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.