CVE-2026-108870: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filters to widen readable records or altering filtering for other roles.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What access could an attacker gain by changing data rules?
The attacker can overwrite data_rule_ids for roles, including clearing row-level filters. This can widen the records readable by affected roles or change filtering applied to other roles.
What request data is used to alter a role's data rules?
The vulnerable saveDatarule handler accepts permissionId, roleId, and dataRuleIds. A low-privileged authenticated user can submit these values to POST /sys/role/datarule without the required authorization check.
Which versions are identified as affected?
JeecgBoot through version 3.9.5 is identified as affected.