CVE-2026-111688: Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it. The attacker needs access to the department getByParentId or search endpoints and can add the openDataFilter=false parameter to the request.
What information can be exposed?
The bypass allows retrieval of the organization’s full department tree and department names, including departments outside the user’s assigned data scope. The provided information does not indicate exposure of other department attributes or modification capabilities.
Are systems affected by default?
The issue affects deployments that use XBoot’s role-based data-scope restrictions for department access and expose the affected department endpoints to authenticated users. The supplied data does not state whether any particular default role or configuration prevents exploitation.
How can I check whether my deployment is vulnerable?
Using a low-privileged authenticated account with restricted department scope, request the department getByParentId or search endpoint with openDataFilter=false. The deployment is affected if the response includes departments outside that account’s assigned scope.