CVE-2026-108888: JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download all sysdepartrole records, including role names, codes, descriptions and creating users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user can exploit it, including a low-privileged account assigned only the default minimal role. No elevated administrative role is required.
What information can be exposed?
The endpoint can export all sys_depart_role records. Exposed fields include department-role names, codes, descriptions, and the users that created the records.
What request path should defenders monitor for exploitation?
Monitor authenticated requests to /sys/sysDepartRole/exportXls, particularly from accounts that would not normally be permitted to export department-role data. Successful use results in a downloadable export of the department-role records.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.