EUVD-2026-97048
GHSA-v9j5-w9hf-2fc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any low-privileged account
-
ExploitSend PUT /sys/user/changeDepartChargePerson with arbitrary userId/department/status
-
ImpactGain department-head role and widened department-scoped data access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level (CVSS PR:L) plus network reachability to the /sys/user/changeDepartChargePerson endpoint; no special feature toggle or non-default configuration is needed - the endpoint lacks an authorization check by default. The principal limiting factor is that exploitation is NOT possible unauthenticated: an attacker must first obtain or already possess low-privilege credentials, and the impact is confined to department-head assignment (and the data-scope changes that follow), not full account or system takeover. |
| Impact | This is a moderate-severity, authenticated authorization flaw (CWE-862) rather than a critical remote-code vulnerability, and the signals are internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) describes a network-reachable endpoint that any authenticated, low-privileged user can abuse with low complexity and no user interaction, but with impact limited to integrity (VI:L) - modifying department-head assignments - and explicitly no confidentiality or availability impact. A public POC exists (VulnCheck/AnkesKasty), which raises practical exploitability, but the CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The key tension: VC:N (no confidentiality impact) sits uneasily with the description's note that promoting a user to department head 'widens department-scoped views' - that outcome is plausibly a confidentiality gain, so the official scoring may understate data-exposure risk. Bottom line: a real but bounded issue - a privilege/authorization abuse requiring a pre-existing valid account, best triaged as medium priority, not an emergency, absent KEV/EPSS escalation. |
| Exploit ScenarioDerived | A low-privileged employee with any valid JeecgBoot account sends a single crafted PUT request to /sys/user/changeDepartChargePerson supplying an arbitrary userId, department id, and status. Because the endpoint fails to verify the caller's authorization, the attacker promotes their own account (or a confederate) to department head, broadening the data visible under that department, or demotes a legitimate head. A public Python POC for this exact endpoint is available, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user - regardless of privilege level - to reassign or remove department heads by sending a PUT request to /sys/user/changeDepartChargePerson with arbitrary user, department, and status values. Attackers must already hold a valid low-privilege account (CVSS PR:L) and network reachability to the endpoint, so this is an authenticated authorization flaw (CWE-862) rather than a pre-auth or remote-code issue; the impact is limited to integrity of department-head assignments (CVSS 4.0 base 5.3, assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and the department-scoped data visibility that follows. Publicly available exploit code exists (a Python PoC published on GitHub and referenced by VulnCheck), but there is no CISA KEV entry indicating confirmed active exploitation; no vendor-released patch version is identified in the available data.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to confirm and apply any fixed JeecgBoot release above 3.9.5 as soon as JeecgBoot publishes one, tracking the upstream repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-changedepartchargeperson). Until then, add an explicit authorization check on the PUT /sys/user/changeDepartChargePerson handler - annotate it with the platform's permission guard (e.g., @RequiresPermissions/@PreAuthorize scoped to system:user:edit or an equivalent department-admin role) so that only holders of the appropriate administrative permission can invoke it; this is the most direct fix but requires a code change and redeployment. As a compensating control, restrict network reachability to the endpoint at the reverse proxy or WAF layer so that only trusted administrative networks or IP ranges can reach /sys/user/changeDepartChargePerson, accepting that legitimate administrators outside those ranges are blocked. Additionally, review and baseline department-head assignments and audit logs for unexpected changeDepartChargePerson calls, and consider tightening data-scope rules so that department-head membership does not silently widen visibility until the authorization gap is closed. Note these mitigations reduce exposure but do not remove the underlying missing-authorization defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module (jeecg-system-biz) exposes administrative REST controllers. The relevant code path is SysUserController (jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java, roughly lines 2007-2011), which implements the PUT /sys/user/changeDepartChargePerson endpoint. Per the CWE-862 (Missing Authorization) classification, this handler does not enforce the permission/role check that sibling administrative endpoints rely on (e.g., Spring Security @PreAuthorize/@RequiresPermissions annotations or equivalent interceptors), so the authorization decision is effectively delegated to authentication alone. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* with no version qualifier reflects that the flaw is present across the product line through 3.9.5. Because department-head status drives JeecgBoot's department-scoped data views and row-level style visibility, the assignment operation is a privileged state change whose missing check lets a low-privileged caller mutate organizational authorization data.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint callable by any authenticated low-privileged user (PR:L, AC:L, UI:N); impact limited to altering authorization data (I:L), with no confidentiality or availability loss per vendor scoring.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB