CVE-2026-108636

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability in the SysDepartController appImportExcel handler. This flaw allows any authenticated user to perform actions typically reserved for administrators. Specifically, a low-privileged attacker can upload a crafte...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...

CVE-2026-108635

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability (CWE-862) within the SysDepartController component. Specifically, the GET /sys/sysDepart/getDepartmentHead endpoint fails to adequately restrict access, allowing any authenticated user to view department sta...

CVE-2026-108633

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/sysDepartPermission/add endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by submitting arbitrary departId, permissionId, and dataRuleIds fiel...

CVE-2026-108634

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the sysDepartPermission component. Specifically, the DELETE /sys/sysDepartPermission/deleteBatch endpoint fails to properly validate permissions, allowing low-privileged authenticated users to delete departm...

CVE-2026-108632

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the SysDepartPermissionController's queryById handler. This security weakness allows any authenticated user to access and read sensitive department permission records. Specifically, low-privileged attackers can...

CVE-2026-108631

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController delete handler. This vulnerability allows low-privileged authenticated users to delete department permission bindings . An attacker can first obtain row IDs from an unguarded list ...

CVE-2026-108630

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController . This vulnerability allows any authenticated user to modify department permission records via the /sys/sysDepartPermission/edit endpoint. An attacker with low privileges can first...

CVE-2026-108629

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler within the SysDepartPermissionController. This vulnerability allows any authenticated user to perform unauthorized actions on department data rules. By sending departId, permissionId, and d...

CVE-2026-108627

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the loadDatarule handler of the SysRoleController component. This flaw allows any authenticated user to perform unauthorized queries via the GET /sys/role/datarule/{permissionId}/{roleId} endpoint. A l...

CVE-2026-108628

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDeptRolePermission endpoint of the SysDepartPermissionController. This vulnerability allows any authenticated user to modify department role permissions by submitting roleId and permissionIds values. Con...

CVE-2026-108626

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController's queryById handler. This vulnerability allows low-privileged authenticated users to access arbitrary message push records by supplying specific IDs to the GET /sys/message/sysMessage/query...

CVE-2026-108624

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController deleteBatch handler. This vulnerability allows low-privileged authenticated users to delete message records by obtaining record IDs from an unguarded list endpoint and submitting them to th...

CVE-2026-108625

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the sysMessage Edit endpoint. Low-privileged authenticated users can call PUT /sys/message/sysMessage/edit to modify message push records by providing any sys_sms record id . The lack of ownership checks allows att...

CVE-2026-108623

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysLogController deleteBatch handler. This vulnerability allows any authenticated user to delete system audit log entries. Specifically, low-privileged attackers can execute a DELETE request with ids set to all...

CVE-2026-108622

The JeecgBoot framework (through version 3.9.5 ) is affected by a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user to delete audit log entries. An attacker with low privileges can exploit this by first obtaining log IDs from the u...

CVE-2026-108621

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController edit handler. This vulnerability allows any authenticated user to modify organizational positions by sending PUT or POST requests to the /sys/position/edit endpoint. A low-privileged attac...

CVE-2026-108620

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController deleteBatch handler. This vulnerability allows any authenticated user to delete organizational positions by sending comma-separated position IDs. Attackers can first obtain the...

CVE-2026-108619

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the sysMessageTemplate component. Specifically, the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint fails to properly restrict access, allowing low-privileged authenticated users to delete mes...

CVE-2026-108618

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the sysMessageTemplate edit endpoint. Low-privileged authenticated users can exploit the PUT /sys/message/sysMessageTemplate/edit request to overwrite system notification titles and content. Attackers c...