CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108628

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDeptRolePermission endpoint of the SysDepartPermissionController. This vulnerability allows any authenticated user to modify department role permissions by submitting roleId and permissionIds values. Con...

CVE-2026-108628

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108627

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108627 JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-108627 JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108627

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the loadDatarule handler of the SysRoleController component. This flaw allows any authenticated user to perform unauthorized queries via the GET /sys/role/datarule/{permissionId}/{roleId} endpoint. A l...

CVE-2026-108627 JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108626

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose messa...

CVE-2026-108626 JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose messa...

CVE-2026-108626 JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose messa...

CVE-2026-108626 JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose messa...

CVE-2026-108626

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController's queryById handler. This vulnerability allows low-privileged authenticated users to access arbitrary message push records by supplying specific IDs to the GET /sys/message/sysMessage/query...

CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

CVE-2026-108624

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

CVE-2026-108624

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController deleteBatch handler. This vulnerability allows low-privileged authenticated users to delete message records by obtaining record IDs from an unguarded list endpoint and submitting them to th...