CVE-2026-108873

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/user/doUpdateDepartInfo endpoint. This vulnerability allows low-privileged authenticated users to modify any department by performing a PUT request. Specifically, an attacker can provide a depart...

EUVD-2026-97047

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

EUVD-2026-96568

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...