EUVD-2026-96573
GHSA-p474-hcmv-9rv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitQuery unguarded list endpoint for row ids
-
ExecutionSubmit ids to DELETE deleteBatch endpoint
-
ImpactRemove department permission bindings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session as a low-privileged user (PR:L) with access to the JeecgBoot system module; no admin rights and no user interaction are needed. The specific prerequisite is reaching the DELETE /sys/sysDepartPermission/deleteBatch endpoint, which lacks the authorization check that should restrict it, combined with the companion list endpoint being unguarded so the attacker can enumerate the row ids to supply in the ids parameter. Limiting factors: exploitation is impossible for fully unauthenticated attackers, impact is confined to deleting department permission bindings (no data theft), and realistic risk is highest in multi-tenant or multi-department JeecgBoot deployments where low-privileged accounts coexist with sensitive department permission configurations. |
| Impact | This is a moderate-risk, authenticated authorization flaw rather than a critical issue, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity attack that nevertheless requires an already-authenticated low-privileged account (PR:L), so this is a privilege/authorization problem exploitable only by insiders or attackers who have first obtained valid low-level credentials - not an unauthenticated internet-wide threat. Impact is limited and integrity/availability-oriented (VC:N/VI:L/VA:L): no data disclosure, but an attacker can delete department permission bindings, disrupting the menus and buttons departments can grant to their roles. Publicly available exploit code exists (POC from the researcher), which raises practical reproducibility, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat the POC as a proof of reproducibility, not as confirmation of in-the-wild use. Net: a real but bounded issue best prioritized for internal multi-tenant JeecgBoot deployments; patch on a normal cadence rather than as an emergency. No EPSS/KEV data was supplied, so widespread-exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user queries the unguarded department-permission list endpoint to harvest row ids, then issues a DELETE request to /sys/sysDepartPermission/deleteBatch with those ids in the ids parameter to remove permission bindings they should not control. A public POC (poc_depart_permission_delete_batch.py) demonstrates the full request flow. Because the CVSS vector is AV:N/AC:L, the attack is remote and low-complexity, but it still requires a valid low-privilege session (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated low-privileged user delete department permission bindings through the DELETE /sys/sysDepartPermission/deleteBatch endpoint, silently stripping the menus and buttons a department can grant to its roles. Exploitation requires only a valid low-privileged session (CVSS vector PR:L) with no admin rights and no user interaction, because the companion list endpoint is also unguarded and exposes the row ids that must be submitted in the ids parameter. Publicly available exploit code exists, including a published Python PoC, and no confirmed active exploitation is reported in the available intelligence sources; with integrity and availability impact limited to permission records and no confidentiality loss, this is a moderate-risk authenticated authorization flaw rather than a critical one.
RemediationAI
No vendor-released patch identified at time of analysis: the available references point to the vulnerable controller source and the VulnCheck advisory but specify no fixed version, so teams should track the project repository and advisory for an updated release. Until a fix ships, add the missing authorization check to SysDepartPermissionController.deleteBatch (and to the unguarded list handler that enables id enumeration) using the same permission annotation or role requirement that guards comparable system-module administrative endpoints, then redeploy - this is a source-level change that must be reapplied after each upstream upgrade until a patched release is adopted, and leaving the list endpoint open would preserve the reconnaissance step even if the delete path is fixed. As an interim compensating control, block or reject DELETE requests to /sys/sysDepartPermission/deleteBatch at the reverse proxy, WAF, or Spring Security filter chain for every role except the administrators who legitimately maintain department bindings; the trade-off is that authorized admins must be allowlisted by identity or path or perform the change server-side, and aggressive blocking can break legitimate permission-maintenance workflows. Where the system module cannot be tightly scoped, restrict network access to it and audit all accounts holding any department-level role, since those accounts can enumerate the ids required for the attack, and alert on bulk deletions of sys_depart_permission rows because bindings removed this way must be recreated manually to restore the affected menus and buttons. Applying least privilege to low-privileged accounts reduces the pool of viable attackers but does not close the underlying flaw, and the publicly available PoC means external scanning attempts against exposed endpoints should be expected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module (jeecg-module-system) exposes REST controllers for users, roles, departments, and permission bindings. CVE-2026-108634 is a CWE-862 missing authorization defect in SysDepartPermissionController: the deleteBatch handler mapped to DELETE /sys/sysDepartPermission/deleteBatch performs a batch delete of sys_depart_permission rows without enforcing the permission check that guards comparable administrative operations, and the associated list endpoint is also reachable by low-privileged accounts, making the required row ids enumerable before the delete is issued. Department permission bindings are the join records that determine which menus and buttons a department may assign to its roles, so removing them degrades the platform's UI-level access-control configuration rather than exposing or exfiltrating data. The vulnerable code path is publicly visible in the project repository, and the vulnerability was reported by VulnCheck, which also classifies the affected range via the wildcarded CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable endpoint and low complexity, but an authenticated low-privilege account is required (PR:L); deleting permission bindings affects integrity and availability (I:L/A:L) with no disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB