CVE-2026-108628: JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.
What access does an attacker need to gain or change permissions?
The attacker needs a valid authenticated session and the ability to submit requests to the saveDeptRolePermission endpoint. They can supply roleId and permissionIds values to alter department role permissions.
What is the likely impact of successful exploitation?
An attacker can grant arbitrary menu or button permissions to department roles, potentially escalating privileges. They can also revoke permissions assigned to other users through affected role changes.
Which versions are identified as affected?
JeecgBoot through version 3.9.5 is identified as affected.