EUVD-2026-96575
GHSA-ww57-4vw8-q38h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft malicious Excel workbook
-
ExploitPOST to /sys/sysDepart/appImportExcel
-
ExecutionBypass missing authorization check
-
ImpactInject arbitrary sys_depart records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the JeecgBoot instance at any privilege level (CVSS PR:L; the description specifies 'any authenticated user'), with network reachability to the /sys/sysDepart/appImportExcel endpoint. No administrator role, no user interaction, and no non-default configuration are needed - the appImportExcel handler simply omits the authorization check that should restrict department imports to administrators. The practical limiting factor is the authentication requirement: exploitation is not possible by a fully unauthenticated attacker, so exposure depends on how freely low-privilege accounts are granted. Impact is bounded to creating arbitrary sys_depart records; there is no path to code execution, data disclosure, or service disruption from this flaw alone. |
| Impact | This is a medium-severity, lower-priority issue in practice. The CVSS 4.0 signals (AV:N/AC:L/AT:N/PR:L/UI:N) describe a remotely reachable, low-complexity flaw requiring only low-privilege authentication, and the impact is confined to partial integrity (VI:L) with no confidentiality or availability loss (VC:N/VA:N) - consistent with a missing-authorization (CWE-862) weakness that lets a non-admin create department records rather than achieving code execution or data theft. Publicly available exploit code (VulnCheck advisory plus a GitHub PoC) raises operational likelihood, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at this time. The CVSS vector (PR:L, authenticated) aligns with the description ('any authenticated user'), so no signals conflict here. Net: a genuine authorization-model defect worth patching, but the low technical impact (only unauthorized creation of sys_depart entries, no scope change) keeps real-world risk modest and below higher-impact RCE/auth-bypass issues competing for the same remediation window. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (e.g., a normal app account) submits a crafted Excel workbook to POST /sys/sysDepart/appImportExcel, an endpoint that fails to enforce administrator-only authorization. This lets the attacker inject arbitrary records into the admin-maintained sys_depart department tree, corrupting organizational structure or staging follow-on abuse. A working PoC is publicly available (GitHub poc_c091_sysdepart_appimport_xlsx.py and the VulnCheck advisory). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user, regardless of role, to upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel and create arbitrary sys_depart records in the administrator-maintained department tree. Exploitation requires only a valid low-privilege session with network reachability to the endpoint, and publicly available exploit code exists; however, the impact is confined to integrity (CVSS 3.1 base 5.3, PR:L, I:L, C:N, A:N), with no code execution, data disclosure, or service disruption possible from this flaw alone. This is a medium-severity, lower-priority issue in practice that matters mainly where low-privilege accounts are freely provisioned.
RemediationAI
No vendor-released patch for this missing-authorization flaw is identified in the provided data for JeecgBoot through 3.9.5, so the primary action is to add the absent authorization check upstream or in a fork: annotate the SysDepartController.appImportExcel handler with an administrator-only permission such as @PreAuthorize("@PermissionData.checkPermission('system:sysDepart:import')") or the platform's @RequiresPermissions equivalent, mirroring the checks used by the other department-management methods in the same controller, and redeploy the patched jeecg-system-biz artifact. Until that code change is shipped, restrict the endpoint at the perimeter: block POST /sys/sysDepart/appImportExcel for all non-administrator roles at the reverse proxy or WAF and return 403, accepting that legitimate administrative bulk imports must be run through a separate allowlisted path or performed directly in the database during the interim; be aware that path-based WAF rules keyed on a static URI can be evaded with URL-encoding or path-normalization tricks and need retrospective log tuning. Complement this with monitoring and remediation of the data layer: audit sys_depart for unexpected or attacker-created rows and roll them back, alert on appImportExcel calls originating from low-privilege accounts, and review how freely non-administrative JeecgBoot accounts are issued, since the entire attack surface here depends on the attacker already holding a valid session. Track the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepart-appimportexcel and the referenced source at https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartController.java#L682-L717 for an official fix version once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code rapid application development platform; the affected component is the jeecg-system-biz module, specifically the SysDepartController handler appImportExcel (source lines 682-717 of the referenced commit). The handler parses an uploaded Excel workbook and inserts the resulting rows directly into the sys_depart table, which backs the platform's department/organization hierarchy. The root cause is CWE-862 Missing Authorization: unlike sibling department-management endpoints, appImportExcel lacks the @PreAuthorize or @RequiresPermissions check that would restrict the operation to administrators, so Spring Security authenticates the caller but never authorizes the action. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is unversioned in the feed, consistent with the advisory's statement that all releases through 3.9.5 are affected; the CVSS 4.0 vector supplied in the CVE record (PR:L, VI:L, all confidentiality and availability metrics None) agrees with the independent CVSS 3.1 assessment, confirming a purely integrity-affecting authorization gap reachable over the network without user interaction.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote endpoint reachable by any authenticated user (AV:N/AC:L/PR:L/UI:N); only partial integrity via unauthorized record creation (I:L), no confidentiality or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB