CVE-2026-108633 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

CVE-2026-108634 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit the...

CVE-2026-108633 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

CVE-2026-108634

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the sysDepartPermission component. Specifically, the DELETE /sys/sysDepartPermission/deleteBatch endpoint fails to properly validate permissions, allowing low-privileged authenticated users to delete departm...

CVE-2026-108633

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/sysDepartPermission/add endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by submitting arbitrary departId, permissionId, and dataRuleIds fiel...

CVE-2026-108632

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the SysDepartPermissionController's queryById handler. This security weakness allows any authenticated user to access and read sensitive department permission records. Specifically, low-privileged attackers can...

CVE-2026-108632 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to...

CVE-2026-108632 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to...

CVE-2026-108631

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController delete handler. This vulnerability allows low-privileged authenticated users to delete department permission bindings . An attacker can first obtain row IDs from an unguarded list ...

CVE-2026-108631 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE request...

CVE-2026-108630 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwri...

CVE-2026-108631 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE request...

CVE-2026-108630

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController . This vulnerability allows any authenticated user to modify department permission records via the /sys/sysDepartPermission/edit endpoint. An attacker with low privileges can first...

CVE-2026-108630 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwri...

CVE-2026-108629

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler within the SysDepartPermissionController. This vulnerability allows any authenticated user to perform unauthorized actions on department data rules. By sending departId, permissionId, and d...

CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108628

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDeptRolePermission endpoint of the SysDepartPermissionController. This vulnerability allows any authenticated user to modify department role permissions by submitting roleId and permissionIds values. Con...