CVE-2026-108640

The JeecgBoot framework, versions through 3.9.5 , contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController queryById handler. The root cause is the absence of necessary Shiro permission annotations , which allows low-privileged authenticated attackers to perform una...