CVE-2026-108633: JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants to any department for delegation to its roles.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated JeecgBoot account with low privileges. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What access can an attacker gain through the vulnerable endpoint?
The attacker can create permission bindings for arbitrary departments by supplying departId, permissionId, and dataRuleIds values. This can attach menu, button, and data-rule grants to a department for delegation to that department's roles.
Are all JeecgBoot deployments affected by default?
The available data identifies JeecgBoot through version 3.9.5 as affected, but does not establish whether the endpoint or the relevant permission model is enabled in every default deployment.