CVE-2026-108875 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...

CVE-2026-108873

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/user/doUpdateDepartInfo endpoint. This vulnerability allows low-privileged authenticated users to modify any department by performing a PUT request. Specifically, an attacker can provide a depart...

CVE-2026-108873 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

EUVD-2026-97047

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

CVE-2026-108872 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

EUVD-2026-97045

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

EUVD-2026-97046

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler of the SysDepartRoleController. This vulnerability allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds...

CVE-2026-108872

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the batchEditUsers handler of the SysUserController. This vulnerability allows any authenticated user to send PUT requests to /sys/user/batchEditUsers using arbitrary user and department IDs. Consequent...

CVE-2026-108872 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

CVE-2026-108870

The JeecgBoot framework, versions through 3.9.5 , is vulnerable to a missing authorization flaw in the SysRoleController saveDatarule handler. A low-privileged authenticated user can exploit this by sending permissionId, roleId, and dataRuleIds via a POST request to /sys/role/datarule. This allow...

EUVD-2026-97044

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108870 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108868

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability (CWE-862) accessible via the POST /sys/api/sendBusTemplateAnnouncement endpoint. This flaw allows any authenticated user to publish templated system announcements. A low-privileged attacker can provide specific...

CVE-2026-108869

The JeecgBoot framework (versions through 3.9.5 ) is vulnerable to a missing authorization flaw in the POST /sys/api/sendSysAnnouncement endpoint. This allows low-privileged authenticated users to send forged system announcements to any user. Attackers can provide arbitrary values for the title ,...

EUVD-2026-97043

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

EUVD-2026-97042

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...