CVE-2026-108635: JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit the affected endpoint. The attacker does not need elevated administrative permissions.
What access or information does an attacker need?
The attacker needs valid authentication and must request the GET /sys/sysDepart/getDepartmentHead endpoint. They can enumerate departId values to retrieve department staff information.
What information could be exposed?
The endpoint can disclose staff names, avatars, posts, mobile numbers, and telephone numbers. This includes contact details that are marked hidden.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 are affected. A practical check is to authenticate as a low-privileged user and determine whether requests to GET /sys/sysDepart/getDepartmentHead with enumerated departId values return staff data outside that user's authorized scope.