EUVD-2026-96568

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108629

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler within the SysDepartPermissionController. This vulnerability allows any authenticated user to perform unauthorized actions on department data rules. By sending departId, permissionId, and d...

CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...