Is there a public PoC exploit available for CVE-2025-15120?

Yes, a public proof-of-concept exploit is available for CVE-2025-15120. Prioritise patching immediately. EPSS: 0.0%.

JeecgBoot CVE-2025-15120

Q: What is the CVSS score of CVE-2025-15120?

CVE-2025-15120 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Incorrect Privilege Assignment (CWE-266)

2025-12-28 cna@vuldb.com

Information Disclosure Jeecg Boot

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:43 vuln.today

DescriptionCVE.org

A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.

Technical ContextAI

JeecgBoot is a low-code development platform for rapid application construction. The vulnerability resides in the /sys/sysDepartRole/getDeptRoleList endpoint, which handles department role enumeration. The flaw stems from CWE-266 (Improper Privilege Management), where the endpoint fails to properly validate whether the authenticated user has authorization to access role information for departments they do not own or manage. By supplying an arbitrary departId parameter, an authenticated attacker bypasses authorization checks and retrieves role data across organizational units. The CVE:3.9.0 CPE indicates all versions up to and including 3.9.0 are affected.

RemediationAI

Upgrade JeecgBoot to a version newer than 3.9.0 as soon as feasible. However, note that the vendor has not responded to disclosure and may not have released a patched version; verify patch availability through the official JeecgBoot repository or vendor communication channels before upgrading. As an immediate compensating control, restrict API access to the /sys/sysDepartRole/getDeptRoleList endpoint to users with explicit department administration roles, and implement input validation to ensure departId parameters correspond only to departments the authenticated user is authorized to manage. Log all requests to this endpoint and review access patterns for anomalous departId values. If upgrades are delayed, consider disabling the endpoint entirely if role management can be performed through alternative mechanisms.