CVE-2026-111689: XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint

Q: Who can exploit this issue?

Any authenticated XBoot user who can send requests to the affected endpoint can exploit it. The attacker only needs arbitrary department IDs; no elevated role or user interaction is required.

Q: What information could be exposed?

The endpoint can disclose user records for departments outside the caller's authorized data scope, including usernames, real names, mobile numbers, email addresses, and account status.

Q: Are default deployments affected?

The available information identifies affected XBoot versions through 3.3.4, but does not state whether a particular default role or configuration grants access to this endpoint. Exposure depends on whether authenticated users can reach the endpoint.

Q: How can I check whether my instance is vulnerable?

Using a low-privileged authenticated account, request GET /xboot/user/getByDepartmentId/{departmentId} for a department outside that account's permitted scope. The instance is affected if the response returns that department's user records.

Q: What can be done if patching is not immediately possible?

Restrict access to GET /xboot/user/getByDepartmentId/{departmentId} so that untrusted or low-privileged authenticated users cannot invoke it. Review authorization controls to ensure department queries enforce the caller's role data scope.

Published Oct 16, 2026

Updated

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

Affected Software

1 affected component

Exrick xboot<=3.3.4

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated XBoot user who can send requests to the affected endpoint can exploit it. The attacker only needs arbitrary department IDs; no elevated role or user interaction is required.

What information could be exposed?

The endpoint can disclose user records for departments outside the caller's authorized data scope, including usernames, real names, mobile numbers, email addresses, and account status.

Are default deployments affected?

The available information identifies affected XBoot versions through 3.3.4, but does not state whether a particular default role or configuration grants access to this endpoint. Exposure depends on whether authenticated users can reach the endpoint.

How can I check whether my instance is vulnerable?

Using a low-privileged authenticated account, request GET /xboot/user/getByDepartmentId/{departmentId} for a department outside that account's permitted scope. The instance is affected if the response returns that department's user records.

What can be done if patching is not immediately possible?

Restrict access to GET /xboot/user/getByDepartmentId/{departmentId} so that untrusted or low-privileged authenticated users cannot invoke it. Review authorization controls to ensure department queries enforce the caller's role data scope.

CVE-2026-111689: XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are default deployments affected?

How can I check whether my instance is vulnerable?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are default deployments affected?

How can I check whether my instance is vulnerable?

What can be done if patching is not immediately possible?