CVE-2026-108629: JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker needs network access to the application and valid credentials; no user interaction is required.
What access or configuration is required for exploitation?
The affected endpoint is POST /sys/sysDepartPermission/datarule. An attacker can submit departId, permissionId, and dataRuleIds values to target department-menu permission bindings; the issue is present through JeecgBoot 3.9.5.
What could an attacker change?
An attacker can modify, add, or clear data rules on any department-menu permission binding. This can alter the integrity of department data-rule configuration.