JeecgBoot CVE-2025-15120
LOWSeverity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.
Technical ContextAI
JeecgBoot is a low-code development platform for rapid application construction. The vulnerability resides in the /sys/sysDepartRole/getDeptRoleList endpoint, which handles department role enumeration. The flaw stems from CWE-266 (Improper Privilege Management), where the endpoint fails to properly validate whether the authenticated user has authorization to access role information for departments they do not own or manage. By supplying an arbitrary departId parameter, an authenticated attacker bypasses authorization checks and retrieves role data across organizational units. The CVE:3.9.0 CPE indicates all versions up to and including 3.9.0 are affected.
RemediationAI
Upgrade JeecgBoot to a version newer than 3.9.0 as soon as feasible. However, note that the vendor has not responded to disclosure and may not have released a patched version; verify patch availability through the official JeecgBoot repository or vendor communication channels before upgrading. As an immediate compensating control, restrict API access to the /sys/sysDepartRole/getDeptRoleList endpoint to users with explicit department administration roles, and implement input validation to ensure departId parameters correspond only to departments the authenticated user is authorized to manage. Log all requests to this endpoint and review access patterns for anomalous departId values. If upgrades are delayed, consider disabling the endpoint entirely if role management can be performed through alternative mechanisms.
Share
External POC / Exploit Code
Leaving vuln.today