CVE-2026-108649

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the queryUserRolesById handler of the SystemApiController component. This vulnerability allows authenticated users to access the /sys/api/queryUserRolesById endpoint and retrieve the role codes of any user by p...

CVE-2026-108648

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of the SystemApiController . The root cause is the lack of Shiro permission or role annotations , allowing any authenticated low-privileged user to exploit ...

CVE-2026-108646

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController importExcel handler. This vulnerability allows any authenticated user to upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, includi...

CVE-2026-108647

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability within the SysCheckRuleController importExcel handler. This flaw allows low-privileged authenticated users to bypass the system:checkRule:add permission by uploading a crafted Excel workbook . Successful exp...

CVE-2026-108645

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController component. This vulnerability allows any authenticated user to access the /sys/category/edit endpoint. By sending POST or PUT requests with a specific node ID, low-privileged attackers ...

CVE-2026-108644

JeecgBoot versions up to 3.9.5 are vulnerable to a missing authorization vulnerability in the SysCategoryController delete handler. This flaw allows any authenticated user to delete category dictionary nodes. Attackers with low privileges can identify target node IDs via the unguarded rootList an...

CVE-2026-108643

JeecgBoot through version 3.9.5 is vulnerable to a missing authorization flaw (CWE-862). This allows low-privileged authenticated users to perform unauthorized deletions of category dictionary entries via the DELETE /sys/category/deleteBatch endpoint. Attackers can identify target node IDs using ...

CVE-2026-108642

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the SysAnnouncementSendController . Due to a missing authorization check, authenticated users can access and modify message delivery records belonging to others. Attackers can retrieve delive...

CVE-2026-108641

The JeecgBoot framework, version through 3.9.5 , is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the SysAnnouncementSendController component. Specifically, the getOne handler fails to properly authorize requests, allowing authenticated users to access messages belongi...

CVE-2026-108639

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDictController component. Specifically, the deletePhysic handler fails to perform adequate permission checks, allowing any authenticated user to send DELETE requests to /sys/dict/deletePhysic/{id}. This vuln...

CVE-2026-108640

The JeecgBoot framework, versions through 3.9.5 , contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController queryById handler. The root cause is the absence of necessary Shiro permission annotations , which allows low-privileged authenticated attackers to perform una...

CVE-2026-108638

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController component. Specifically, the deleteGroupUser handler fails to perform ownership or tenant checks, allowing low-privileged authenticated users to issue DELETE requests with arbitrary groupId an...

CVE-2026-108636

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability in the SysDepartController appImportExcel handler. This flaw allows any authenticated user to perform actions typically reserved for administrators. Specifically, a low-privileged attacker can upload a crafte...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...

CVE-2026-108635

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability (CWE-862) within the SysDepartController component. Specifically, the GET /sys/sysDepart/getDepartmentHead endpoint fails to adequately restrict access, allowing any authenticated user to view department sta...

CVE-2026-108633

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/sysDepartPermission/add endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by submitting arbitrary departId, permissionId, and dataRuleIds fiel...

CVE-2026-108634

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the sysDepartPermission component. Specifically, the DELETE /sys/sysDepartPermission/deleteBatch endpoint fails to properly validate permissions, allowing low-privileged authenticated users to delete departm...

CVE-2026-108632

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the SysDepartPermissionController's queryById handler. This security weakness allows any authenticated user to access and read sensitive department permission records. Specifically, low-privileged attackers can...

CVE-2026-108631

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController delete handler. This vulnerability allows low-privileged authenticated users to delete department permission bindings . An attacker can first obtain row IDs from an unguarded list ...

CVE-2026-108630

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDepartPermissionController . This vulnerability allows any authenticated user to modify department permission records via the /sys/sysDepartPermission/edit endpoint. An attacker with low privileges can first...