JeecgBoot CVE-2026-108873

Requires a valid authenticated session on the target JeecgBoot instance at any privilege level, including a low-privileged account (PR:L) - self-registration or any basic user role is sufficient. No non-default configuration, feature flag, or user interaction is needed: the PUT /sys/user/doUpdateDepartInfo endpoint simply omits ownership and tenant authorization checks, so any logged-in user can act on any department id. The primary limiting factor is the authentication requirement; this cannot be exploited by fully unauthenticated remote attackers, and impact is confined to department metadata integrity (rename, re-parent, department-head changes) rather than data disclosure or service disruption.

This is a genuine but moderate-severity access-control flaw, not a drive-by critical. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms it is network-reachable and low-complexity, but PR:L means the attacker must already hold a valid low-privileged account on the JeecgBoot instance, which meaningfully narrows the threat to insiders or attackers who have obtained/registered credentials. Impact is scoped to integrity only (VI:L; VC:N, VA:N), consistent with CWE-862 missing authorization: an attacker can tamper with department records but cannot read sensitive data or deny service through this specific endpoint. Publicly available exploit code exists (a Python POC on GitHub), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability - treat exploitation likelihood as unestablished rather than high. No SSVC decision data was provided. Net: prioritize patching for multi-tenant or large-org JeecgBoot deployments where cross-tenant/cross-department integrity matters, but this does not warrant emergency out-of-band response on CVSS or POC alone.

A user with a low-privileged JeecgBoot account (e.g., a self-registered or basic staff login) sends a crafted PUT request to /sys/user/doUpdateDepartInfo specifying a department id they do not own. Because the endpoint performs no ownership or tenant authorization check, they rename or re-parent that department and replace or remove its assigned department heads, corrupting organizational data potentially across other tenants. A public Python POC for this exact endpoint is available, lowering the skill required to weaponize it.