CVE-2026-108870: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

Q: Who can exploit this issue?

An attacker needs to be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoint is reachable over the network.

Q: What access could an attacker gain by changing data rules?

The attacker can overwrite data_rule_ids for roles, including clearing row-level filters. This can widen the records readable by affected roles or change filtering applied to other roles.

Q: What request data is used to alter a role's data rules?

The vulnerable saveDatarule handler accepts permissionId, roleId, and dataRuleIds. A low-privileged authenticated user can submit these values to POST /sys/role/datarule without the required authorization check.

Q: Which versions are identified as affected?

JeecgBoot through version 3.9.5 is identified as affected.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filters to widen readable records or altering filtering for other roles.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Event

via NVD·04:47 PM

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoint is reachable over the network.

What access could an attacker gain by changing data rules?

The attacker can overwrite data_rule_ids for roles, including clearing row-level filters. This can widen the records readable by affected roles or change filtering applied to other roles.

What request data is used to alter a role's data rules?

The vulnerable saveDatarule handler accepts permissionId, roleId, and dataRuleIds. A low-privileged authenticated user can submit these values to POST /sys/role/datarule without the required authorization check.

Which versions are identified as affected?

JeecgBoot through version 3.9.5 is identified as affected.

CVE-2026-108870: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain by changing data rules?

What request data is used to alter a role's data rules?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain by changing data rules?

What request data is used to alter a role's data rules?

Which versions are identified as affected?