CVE-2026-108871: JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite dataruleids, widening row-level data access or altering filtering for other department roles.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges may be able to exploit it. The attack is network-accessible and does not require user interaction.
What does an attacker need to send?
The attacker needs to issue a crafted POST request to /sys/sysDepartRole/datarule containing permissionId, roleId, and dataRuleIds values. These values can be used to overwrite data_rule_ids for department roles.
What is the likely impact of successful exploitation?
An attacker can modify department role data rules, potentially widening row-level data access or changing filtering applied to other department roles. The stated impact includes low confidentiality and integrity impact, with no availability impact.
Which versions are identified as affected?
JeecgBoot through version 3.9.5 is identified as affected.