CVE-2026-108631: JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated with a low-privileged JeecgBoot account. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What information does an attacker need before sending the delete request?
The attacker needs the row ID of a department permission binding. The description states that these IDs can be obtained from an unguarded list endpoint.
What is the practical impact of successful exploitation?
An attacker can delete department permission bindings, removing menus or buttons that departments can grant to their roles. This can disrupt assigned access and functionality for affected departments.
Which versions are known to be affected?
JeecgBoot through version 3.9.5 is identified as affected.