CVE-2026-108871

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler of the SysDepartRoleController. This vulnerability allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds...

EUVD-2026-97045

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108640

The JeecgBoot framework, versions through 3.9.5 , contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController queryById handler. The root cause is the absence of necessary Shiro permission annotations , which allows low-privileged authenticated attackers to perform una...