CVE-2026-108874: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need elevated administrative permissions.
What access and inputs are required for exploitation?
The attacker needs valid authentication and the ability to send a PUT request to /sys/user/changeDepartChargePerson. They can provide arbitrary userId, department ID, and status values in the request.
What could an attacker change?
An attacker can assign any user as a department head or remove an existing department head. Assigning department-head status can widen the affected user's department-scoped views.