CVE-2026-108630: JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite departid, permissionid and dataruleids to alter which menus and data rules departments may delegate.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. No user interaction is required.
What information does an attacker need before modifying a department permission record?
The attacker needs a department permission row ID. The description states that these IDs can be obtained from the unguarded list endpoint.
What can an attacker change through the affected endpoint?
An attacker can overwrite depart_id, permission_id, and data_rule_ids in department permission records. This can alter the menus and data rules that departments are able to delegate.
Which versions are identified as affected?
JeecgBoot through version 3.9.5 is identified as affected.