EUVD-2026-96570
GHSA-r27j-3jj2-cq9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate binding ids via unguarded list endpoint
-
ExecutionSend DELETE request with id parameter
-
ImpactRemove department menu/button permission bindings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold any valid low-privileged authenticated account on the JeecgBoot instance (PR:L) - exploitation is not possible unauthenticated. No user interaction, special platform, or non-default configuration is required: the SysDepartPermission list endpoint is unguarded (allowing id enumeration) and the delete handler lacks an authorization check, so the flaw is present in default deployments of JeecgBoot through 3.9.5. The principal limiting factor is the credential requirement; impact is further bounded to deletion of department permission bindings (menus/buttons), with no data disclosure and no ability to escalate beyond RBAC degradation. |
| Impact | This is a genuinely moderate-severity authorization flaw, not an overhyped high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and the signals are internally consistent: network-reachable, low attack complexity, but PR:L means a valid low-privileged authenticated account is required - this is not unauthenticated mass-exploitable. Impact is deliberately scoped low (VC:N, VI:L, VA:L): no confidentiality loss, only limited integrity/availability damage from deleting department permission bindings (menus/buttons), with no scope change (SC/SI/SA:N). Publicly available POC code exists (AnkesKasty GitHub) and the issue was reported by VulnCheck, which raises exploitability, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat it as a credible but lower-priority patch item. The main risk is an insider or a compromised low-privilege tenant degrading an organization's RBAC configuration rather than external takeover. No conflicting signals: the CVSS vector, CWE-862, and description all agree this is an authenticated authorization bypass with limited impact. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user queries the unguarded SysDepartPermission list endpoint to harvest valid binding row ids, then issues DELETE requests with those id values to strip menu/button permissions that departments grant to their roles. A public POC (poc_depart_permission_delete.py) automates this, so exploitation is scriptable once any valid low-privilege session exists. Given AV:N/AC:L, the requests succeed remotely over the network with no user interaction and against default configurations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authenticated low-privileged users can delete department permission bindings in JeecgBoot through 3.9.5 by calling the SysDepartPermissionController delete handler, which performs no authorization check (CWE-862). Because the corresponding list endpoint is also unguarded, an attacker can enumerate the required row ids and then issue DELETE requests that strip menu and button grants from department roles, degrading the instance's RBAC configuration. Publicly available exploit code exists, and the flaw affects default deployments, but the impact is bounded to integrity/availability of permission data - no data disclosure and no privilege escalation beyond RBAC degradation - which is why the vendor score is a moderate 5.3.
RemediationAI
No vendor-released patch version is identified in the available intelligence - the only upstream reference is a link to the vulnerable source lines rather than a fix commit - so remediation currently rests on compensating controls and monitoring the vendor repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartpermission-delete) for an upstream fix; the status is best described as no vendor-released patch identified at time of analysis, and a source-level fix would consist of adding the platform's standard authorization check to the SysDepartPermission delete handler and the list endpoint. In the interim, block DELETE (and GET on the list route) for /sys/sysDepartPermission endpoints at the reverse proxy, API gateway, or WAF for all users who do not administer departments, accepting that legitimate permission administration must then be performed from an allow-listed administrative network or account; tightly restrict who can create accounts and roles, since any valid low-privileged session is sufficient to exploit the flaw (PR:L), and review existing department-role assignments for unexpected deletions of menu/button grants, as the deletion is silent and leaves no obvious configuration error. Because successful exploitation only degrades RBAC rather than exposing data, perimeter controls can be rolled out quickly while the upstream fix is awaited, but note that blocking these routes will break the department-permission management UI for the affected users and any automation that manipulates department permissions programmatically. Enable application and audit logging on SysDepartPermission operations so anomalous bulk deletes can be detected and reversed from database backups or configuration exports.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose administration surface is exposed through REST controllers under the jeecg-system-biz module. SysDepartPermissionController manages the SysDepartPermission join records that bind departments to permission sets (menus and buttons) which their roles then inherit; the delete handler at approximately lines 118-123 of the referenced source file lacks the authorization annotation/check that the platform applies elsewhere, leaving the operation open to any caller holding a valid session. The companion list endpoint is likewise unguarded, which removes the normal barrier of not knowing internal row identifiers and turns a missing-authorization flaw into a directly exploitable one: enumerate ids, then delete by id. CWE-862 (Missing Authorization) is the correct root-cause class, and the CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* with the 'through 3.9.5' constraint indicates the issue is present across the released version lineage rather than in a single build; exploitation requires only network reachability to the application and any valid low-privileged account (CVSS:4.0 PR:L, assessed equivalently as CVSS:3.1 PR:L), with no user interaction and no non-default configuration.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires a valid low-privilege account (PR:L); no confidentiality impact, limited integrity/availability from unauthorized deletion of permission bindings.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB