CVE-2026-111688

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

EUVD-2026-102979

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111688: Incorrect Authorization

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

PT-2026-116087

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

EUVD-2026-97386

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

PT-2026-110571

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An incorrect authorization issue exists in the GET '/supplier/exportExcel' endpoint. This allows authenticated users to bypass role data scope restrictions that are normally enforced by the...

CVE-2026-108871

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler of the SysDepartRoleController. This vulnerability allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds...

EUVD-2026-97045

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108870

The JeecgBoot framework, versions through 3.9.5 , is vulnerable to a missing authorization flaw in the SysRoleController saveDatarule handler. A low-privileged authenticated user can exploit this by sending permissionId, roleId, and dataRuleIds via a POST request to /sys/role/datarule. This allow...

EUVD-2026-97044

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108870 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108870 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

EUVD-2026-96566

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108870: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...