JeecgBoot CVE-2026-9580

The target must be a JeecgBoot deployment at version 3.9.1 or earlier with the /sys/selectDepart endpoint reachable from the attacker's network position; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required to invoke the vulnerable handler. Impact materially depends on the deployment having more than one department or tenant configured - a single-department install offers little for an authorization-bypass to traverse - and on the attacker knowing or enumerating a valid depart identifier, which the public POC in issue #9597 demonstrates. Exploitation is limited where the JeecgBoot instance is behind an authenticating reverse proxy, on a private network, or already upgraded to v3.9.2 where the access check has been corrected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L yields 7.3 (High), with temporal metrics (E:P/RL:O/RC:C) indicating a proof-of-concept exploit, an official remediation, and confirmed reporting - a combination that warrants prompt patching. The low C/I/A impact ratings imply partial rather than complete compromise, consistent with an access-control flaw that exposes data or actions tied to other departments rather than full system takeover. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no confirmation of active mass exploitation; however, a publicly disclosed POC on the project's own GitHub issue tracker materially lowers the barrier for opportunistic scanning. For organizations running JeecgBoot in multi-tenant or multi-department deployments, the practical risk is elevated because the flaw directly undermines the platform's tenancy boundary; for single-department internal deployments, real-world impact is lower. Tag metadata labels this as 'Authentication Bypass,' but the CWE and description more precisely describe authorization bypass post-authentication - verify against the upstream issue thread before classifying for IR purposes.

An attacker reaches the JeecgBoot login flow over the network (no user interaction or credentials required per CVSS PR:N/UI:N) and issues a crafted request to /sys/selectDepart referencing a department identifier the caller should not be entitled to, leveraging the publicly available POC linked from GitHub issue #9597. Because LoginController.selectDepart does not properly verify the caller-to-department binding, the platform returns or assumes a session context tied to an unauthorized department, exposing data and operations belonging to other organizational units. In multi-tenant SaaS deployments of JeecgBoot, this provides a foothold to access data of unrelated customers without further exploitation.