JeecgBoot CVE-2026-108628

The attacker must hold a valid authenticated JeecgBoot session at any privilege level - the description states 'any authenticated user' can reach the saveDeptRolePermission endpoint of SysDepartPermissionController, so the sole gating factor is account access (PR:L), not administrative rights. No specific non-default configuration, feature flag, or deployment mode is required by the description; the vulnerability stems from a missing authorization check (CWE-862) on a standard permission-management endpoint. Limiting factors for defenders: exploitation requires at least one obtainable low-privilege credential, so environments that disable self-registration, restrict account provisioning, and are not internet-exposed materially reduce realistic exposure; conversely, any instance allowing untrusted users to register is directly at risk. Affected: JeecgBoot through 3.9.5.

This is a genuine, actionable priority rather than an inflated-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a single low-privilege authenticated account and no user interaction - and that vector is fully consistent with the description, which explicitly states 'any authenticated user' can invoke the saveDeptRolePermission endpoint. VulnCheck (the reporter) also links a working Python POC (poc_dept_role_policy_reads_and_save.py), so exploitation is not theoretical. The signals converge: public exploit code exists, the barrier is merely holding any valid low-privilege session, and the impact is a direct vertical privilege escalation (VC:H/VI:H) against the application's own authorization model. The principal uncertainty is exposure probability, not technical validity: no EPSS score and no CISA KEV entry were provided in the input, so there is no confirmation of active in-the-wild exploitation and no quantified likelihood - absence of these is not evidence of low risk, but it does mean 'widespread active exploitation' cannot be asserted. SSVC-style framing: exploitation = POC-available (public), automatable = likely yes (single scripted request once authenticated), technical impact = total within the application's authz boundary. Net: treat as high priority wherever any untrusted or semi-trusted user can obtain a JeecgBoot account.

A low-privileged but legitimate JeecgBoot user (e.g., a self-registered or minimally provisioned account) sends a crafted request to the saveDeptRolePermission endpoint supplying a roleId and attacker-chosen permissionIds, granting their own role arbitrary menu/button permissions and escalating to administrative capability - or stripping permissions from other roles to disrupt operations. A public Python POC from VulnCheck (poc_dept_role_policy_reads_and_save.py) automates this read-and-save flow, and because the CVSS vector is AV:N/AC:L/PR:L/UI:N the attack needs only network access and any valid session, with no victim interaction.