CVE-2026-111603

PlayEdu versions through 2.3 are affected by a missing authorization vulnerability within the CourseController . The root cause is the omission of a department visibility check , which allows authenticated students to access department-restricted courses. Attackers can perform ID enumeration on s...

EUVD-2026-102506

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records,...

EUVD-2026-102505

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with...

CVE-2026-111365

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with...

CVE-2026-111366

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records,...

CVE-2026-111366

The cool-admin-midway application, through version 8.0.0 , is vulnerable to an authorization bypass (CWE-639) within the /admin/sys/user endpoints. This flaw allows department-limited administrators to manage users outside of their assigned departments by providing arbitrary user IDs . Attackers ...

CVE-2026-111355 zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...

CVE-2025-51403

Exploit Title: LiveHelperChat 4. Save the changes. 5. Revist the Department Assignment settings page and edit the Alias Nick field, the...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763

The lamp-boot framework (versions 4.16.0-java17 through 4.21.2-java17 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the oauth module . The issue exists in the /anyone/findDeptByCompany endpoint, which fails to perform proper URI permission checks. This flaw allows aut...

EUVD-2026-101563

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-108874

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user...

CVE-2026-108873

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

CVE-2026-108871

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...

EUVD-2026-97048

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user...

CVE-2026-108874

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability. An authenticated user can call the PUT /sys/user/changeDepartChargePerson endpoint to assign or remove department heads. A low-privileged attacker can provide arbitrary userId , department id , and status va...

CVE-2026-108874 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user...

CVE-2026-108873 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...