CVE-2026-108871

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler of the SysDepartRoleController. This vulnerability allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds...

CVE-2026-108870

The JeecgBoot framework, versions through 3.9.5 , is vulnerable to a missing authorization flaw in the SysRoleController saveDatarule handler. A low-privileged authenticated user can exploit this by sending permissionId, roleId, and dataRuleIds via a POST request to /sys/role/datarule. This allow...

EUVD-2026-97044

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

EUVD-2026-96566

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108627

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the loadDatarule handler of the SysRoleController component. This flaw allows any authenticated user to perform unauthorized queries via the GET /sys/role/datarule/{permissionId}/{roleId} endpoint. A l...