EUVD-2026-96570

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE request...

EUVD-2026-96568

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

EUVD-2026-96567

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

EUVD-2026-96569

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwri...

EUVD-2026-96571

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to...

CVE-2026-108632

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the SysDepartPermissionController's queryById handler. This security weakness allows any authenticated user to access and read sensitive department permission records. Specifically, low-privileged attackers can...

CVE-2026-108630

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController . This vulnerability allows any authenticated user to modify department permission records via the /sys/sysDepartPermission/edit endpoint. An attacker with low privileges can first...

CVE-2026-108631

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController delete handler. This vulnerability allows low-privileged authenticated users to delete department permission bindings . An attacker can first obtain row IDs from an unguarded list ...

CVE-2026-108629

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler within the SysDepartPermissionController. This vulnerability allows any authenticated user to perform unauthorized actions on department data rules. By sending departId, permissionId, and d...

CVE-2026-108628

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDeptRolePermission endpoint of the SysDepartPermissionController. This vulnerability allows any authenticated user to modify department role permissions by submitting roleId and permissionIds values. Con...