Exrick XBoot EUVD-2026-102979

Requires a valid authenticated XBoot account whose role carries data-scope (organizational) restrictions - the attacker must already be logged in. The concrete trigger is appending the request parameter openDataFilter=false to the department getByParentId or search endpoints, which disables the server-side data-scope filter in DepartmentServiceImpl. Limiting factors: exploitation is impossible without authentication (PR:L), and impact is confined to disclosure of department tree structure and names - it does not expose user credentials, modify data, or affect availability. Applies to XBoot through version 3.3.4.

This is a medium-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (base 5.3) describes a network-reachable (AV:N), low-complexity (AC:L) attack that requires a valid low-privilege authenticated session (PR:L) with no user interaction (UI:N), yielding only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N). No EPSS probability, SSVC decision data, or KEV listing was provided in the input, and there is no POC flag - so there is no public exploit identified at time of analysis (a third-party HackMD write-up documenting the bypass technique is referenced, but it is not flagged as weaponized exploit code). The realistic priority is LOW-to-MEDIUM: exploitation leaks an organization's department tree and names beyond the attacker's assigned data scope, which is a horizontal/privacy-boundary breach useful for reconnaissance, but it does not grant code execution, data modification, or access to sensitive record contents. Missing signals to verify: EPSS score and SSVC exploitation/automatable values were not supplied, so widespread-scanning likelihood cannot be quantified from the input.

An authenticated low-privilege XBoot user whose role normally restricts them to their own department appends openDataFilter=false to a department getByParentId or search request. The server skips the data-scope filter and returns the full organizational department tree and names, exposing structure the user was never authorized to see. No public weaponized exploit is flagged, though a HackMD write-up publicly documents the exact parameter and technique.