CVE-2026-108871: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

Q: Who can exploit this issue?

Any authenticated user with low privileges may be able to exploit it. The attack is network-accessible and does not require user interaction.

Q: What does an attacker need to send?

The attacker needs to issue a crafted POST request to /sys/sysDepartRole/datarule containing permissionId, roleId, and dataRuleIds values. These values can be used to overwrite data_rule_ids for department roles.

Q: What is the likely impact of successful exploitation?

An attacker can modify department role data rules, potentially widening row-level data access or changing filtering applied to other department roles. The stated impact includes low confidentiality and integrity impact, with no availability impact.

Q: Which versions are identified as affected?

JeecgBoot through version 3.9.5 is identified as affected.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite dataruleids, widening row-level data access or altering filtering for other department roles.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with low privileges may be able to exploit it. The attack is network-accessible and does not require user interaction.

What does an attacker need to send?

The attacker needs to issue a crafted POST request to /sys/sysDepartRole/datarule containing permissionId, roleId, and dataRuleIds values. These values can be used to overwrite data_rule_ids for department roles.

What is the likely impact of successful exploitation?

An attacker can modify department role data rules, potentially widening row-level data access or changing filtering applied to other department roles. The stated impact includes low confidentiality and integrity impact, with no availability impact.

Which versions are identified as affected?

JeecgBoot through version 3.9.5 is identified as affected.

CVE-2026-108871: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

What is the likely impact of successful exploitation?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

What is the likely impact of successful exploitation?

Which versions are identified as affected?