EUVD-2026-96568
GHSA-42x3-jmxr-w79h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft POST to /sys/sysDepartPermission/datarule
-
ExploitSupply arbitrary departId/permissionId/dataRuleIds
-
ExecutionMissing authorization check bypassed
-
ImpactAlter or clear department data rules
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level (PR:L) with network access to the application's /sys/sysDepartPermission/datarule endpoint; no special feature toggle or non-default configuration is named in the description. The exploit targets the saveDatarule handler of SysDepartPermissionController and works against standard multi-department/data-rule deployments where department-menu permission bindings exist. The principal limiting factor is the authentication requirement - fully unauthenticated external attackers cannot trigger it, so realistic risk concentrates in environments with multiple or untrusted low-privilege users; no user interaction is required (UI:N). |
| Impact | This is a genuine-but-moderate access-control issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw requiring only low-privileged authentication, with impact limited to integrity (VI:L) - no confidentiality (VC:N) or availability (VA:N) loss and no scope change (SC:N/SI:N/SA:N), consistent with CWE-862 Missing Authorization. Public exploit code exists (VulnCheck advisory plus a GitHub PoC), which raises practical exploitability, but the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the signals point to a disclosed, PoC-backed issue rather than a confirmed in-the-wild campaign. The key limiting factor is that the attacker must already hold a valid (even if low-privileged) account, so this is primarily a privilege-escalation/tenant-isolation concern for multi-user JeecgBoot deployments rather than a remote-unauthenticated breach. EPSS and KEV data are absent from the input; this is stated rather than assumed, and defenders should treat the risk as credible internal-threat exposure, not confirmed mass exploitation. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user sends a crafted POST to /sys/sysDepartPermission/datarule supplying arbitrary departId, permissionId and dataRuleIds values. Because the saveDatarule handler omits an authorization check, the request succeeds and the attacker adds, alters or clears the data-scoping rules on any department-menu permission binding, undermining row-level data isolation for departments they should not control. A public Python PoC (poc_depart_permission_datarule.py) demonstrating this request is already available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Any authenticated JeecgBoot user - regardless of privilege level - can add, modify or clear department data-rule bindings by POSTing departId, permissionId and dataRuleIds to /sys/sysDepartPermission/datarule, because the saveDatarule handler in SysDepartPermissionController performs no authorization check, in versions through 3.9.5. Publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV). With a CVSS 5.3 rating reflecting network reachability, low privileges required and only low integrity impact, realistic risk concentrates in multi-department or multi-tenant deployments where untrusted low-privilege accounts exist.
RemediationAI
No vendor-released patch version is identified in the available intelligence at time of analysis; the primary fix is to upgrade JeecgBoot to a release after 3.9.5 once the vendor publishes one, tracking the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-datarule-endpoint) for a fixed build. Until then, a reverse proxy or WAF rule that denies POST requests to /sys/sysDepartPermission/datarule unless they originate from a trusted administrative source will block the exploit path, with the trade-off that legitimate permission-management UI actions using that endpoint from ordinary admin workstations are also blocked and must be performed from the allowed path or temporarily re-enabled. Restricting the endpoint by source IP or role at the gateway produces the same administrative friction. Because the flaw requires only any valid login, tighten account hygiene by limiting low-privilege or untrusted accounts with network access to the application. Since an attacker can silently rewrite department data-rule bindings, audit existing sys_depart_permission and data-rule configurations for unexpected changes, monitor application and proxy logs for POSTs to /sys/sysDepartPermission/datarule from non-admin sessions, and re-verify each department's row-level scoping. A PoC is publicly available at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_datarule.py, so assume motivated low-privilege users can reproduce the request pattern.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose jeecg-system-biz module exposes SysDepartPermissionController to manage bindings between departments, menus and data rules. Data rules provide row-level scoping (for example, restricting a department's users to records they own), so they function as an authorization configuration layer. CVE-2026-108629 is a CWE-862 missing authorization flaw: the saveDatarule handler at lines 205-227 of SysDepartPermissionController (referenced commit e3b9dc0) accepts attacker-supplied departId, permissionId and dataRuleIds but never verifies that the caller is permitted to administer the targeted department-menu permission binding, so any authenticated session can write these values. The CVSS 4.0 vector reports AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, and our independent CVSS 3.1 assessment mirrors this as AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The direct effect is unauthorized modification of access-control configuration, with no confirmed confidentiality or availability loss and no user interaction required.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint reachable by any low-privileged authenticated user (AV:N/AC:L/PR:L/UI:N); impact is unauthorized data-rule modification, so integrity-only (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB