JeecgBoot CVE-2025-15121

Exploitation requires an authenticated session against the JeecgBoot application and the ability to reach the /sys/sysDepartRole/getDeptRoleByUserId endpoint, then supplying an attacker-chosen departId value to retrieve department-role data belonging to other users or departments. Per the vendor CVSS vector, access is authenticated (PR:H) and adjacent-network (AV:A), which limits exploitation to actors already holding privileged credentials and network proximity; however, the AV:A designation is questionable for a web endpoint and may in practice be network-reachable. No special non-default feature or configuration toggle is cited in the description - the vulnerable function appears present in affected versions by default up to 3.9.0. Primary limiting factors: required authentication/privileges and absence of any integrity or availability impact (read-only disclosure).

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The vendor CVSS 4.0 score is 4.8 (Medium), and the vector contains PR:H, meaning exploitation requires high-privilege authenticated access, which sharply limits who can abuse it. Impact is confined to low confidentiality (VC:L) with no integrity or availability impact, consistent with CWE-200 information disclosure. The EPSS score is very low at 0.41% (34th percentile), indicating little evidence of broad opportunistic exploitation, and the CVE is NOT on CISA KEV - so despite the 'publicly available exploit code exists' status, there is no confirmed active exploitation. CONFLICTING SIGNAL: the vendor vector specifies AV:A (Adjacent network), which is unusual for a web application endpoint (/sys/sysDepartRole/getDeptRoleByUserId) that would normally be AV:N (Network) - this discrepancy should be verified, as a network-reachable endpoint would materially widen the exposure. Additionally, PR:H appears high for what reads like an IDOR-style parameter manipulation; a low-privilege authenticated user may plausibly suffice, which would raise real-world risk. Net: a real, confirmed-with-POC authenticated info-disclosure flaw of limited scope and low exploitation probability - prioritize patching but below internet-facing unauthenticated criticals.

An authenticated JeecgBoot user issues a request to /sys/sysDepartRole/getDeptRoleByUserId and tampers with the departId parameter to enumerate department-role associations they should not be able to view, disclosing organizational structure and role assignment data. Public exploit code exists (referenced via GitHub and VulDB), lowering the effort required. Low attack complexity (AC:L) means the manipulation is straightforward once the attacker has the required access.