CVE-2026-108873: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads without ownership or tenant checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker needs network access to the JeecgBoot instance and valid credentials; no user interaction is required.
What can an attacker change through the affected endpoint?
An attacker can submit a department ID to rename or re-parent any department. They can also replace or remove the department heads, without ownership or tenant checks.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 should be considered affected if authenticated users can reach PUT /sys/user/doUpdateDepartInfo. Review requests to that endpoint for department IDs targeting departments not owned by the requesting user or tenant.