CVE-2026-108636: JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sysdepart records in the administrator-maintained department tree.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker needs network access to the application and valid credentials.
What access does exploitation provide?
An attacker can submit a crafted Excel workbook to POST /sys/sysDepart/appImportExcel and create arbitrary sys_depart records in the administrator-maintained department tree. The available information indicates integrity impact only; it does not indicate confidentiality or availability impact.
How can I determine whether my deployment is exposed?
Deployments of JeecgBoot through version 3.9.5 are affected if authenticated users can reach the /sys/sysDepart/appImportExcel endpoint. Review department records and request logs for unexpected Excel imports or unauthorized POST requests to that path.