JeecgBoot CVE-2026-108635

Exploitation requires a valid authenticated session of any privilege level on the JeecgBoot instance (CVSS PR:L); it is not reachable pre-authentication. Given valid credentials, the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController in JeecgBoot versions through 3.9.5 performs no authorization check, so an attacker simply iterates the departId parameter to read staff names, avatars, posts, and mobile/telephone numbers for any department, including entries marked hidden. The limiting factors are: (1) the need for any authenticated account, and (2) impact confined to confidentiality of directory/contact data - no write, code-execution, or availability effect. No special non-default configuration is required; the vulnerable endpoint is part of the standard system module.

This is a moderate-severity information-disclosure issue, not an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability impact - matching the base score of 5.3. The CWE-862 (Missing Authorization) classification and description align well with this vector. A public POC exists (VulnCheck advisory plus a GitHub exploit script), which raises operational concern, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - the signals point to a disclosed-but-not-mass-exploited flaw. The key limiting factor is that exploitation requires a valid authenticated account on the JeecgBoot instance; this is a privilege-escalation-of-data-access issue (any authenticated user reading data they should not), not a pre-auth breach. No signals are strongly conflicting; the main caveat is the absence of EPSS/KEV data, which means exploitation likelihood is inferred only from POC availability.

A low-privileged but authenticated user (or an attacker who has obtained any valid account) sends GET requests to /sys/sysDepart/getDepartmentHead while iterating departId values. Because the endpoint lacks an authorization check, the attacker harvests staff names, avatars, posts, and mobile/telephone numbers across all departments - including contacts flagged as hidden. A public POC (poc_org_scope_reads.py) automates this enumeration, making the attack trivial for anyone holding a session.