CVE-2026-108874: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need elevated administrative permissions.

Q: What access and inputs are required for exploitation?

The attacker needs valid authentication and the ability to send a PUT request to /sys/user/changeDepartChargePerson. They can provide arbitrary userId, department ID, and status values in the request.

Q: What could an attacker change?

An attacker can assign any user as a department head or remove an existing department head. Assigning department-head status can widen the affected user's department-scoped views.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need elevated administrative permissions.

What access and inputs are required for exploitation?

The attacker needs valid authentication and the ability to send a PUT request to /sys/user/changeDepartChargePerson. They can provide arbitrary userId, department ID, and status values in the request.

What could an attacker change?

An attacker can assign any user as a department head or remove an existing department head. Assigning department-head status can widen the affected user's department-scoped views.

CVE-2026-108874: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and inputs are required for exploitation?

What could an attacker change?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and inputs are required for exploitation?

What could an attacker change?