Exrick XBoot EUVD-2026-102980

Requires a valid authenticated XBoot session with at least low privileges (PR:L) - exploitation is not possible unauthenticated. The flaw is in the getByDepartmentId user-lookup endpoint, which ignores the role-based data-scope filter that should restrict a user to their own department's records; it therefore affects default behavior of that endpoint rather than requiring any special configuration. The only limiting factor is the need for an authenticated account; once logged in, any arbitrary department ID can be supplied and no further privilege, user interaction, or non-default setting is required.

This is a genuine but moderate-severity access-control flaw (CWE-639, IDOR). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privileged account, no user interaction, and low confidentiality impact only (no integrity or availability effect). The 5.3 medium score accurately reflects that this leaks data rather than granting control. No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is flagged, so there is no signal of active or probable exploitation - the reporting is from VulnCheck plus a third-party HackMD technical writeup. The practical risk is bounded: an attacker must already hold a valid XBoot account, and the payoff is enumeration of other departments' user PII rather than system compromise. This is best treated as a real-but-not-urgent priority - a confirmed data-exposure bug warranting patching, not an emergency, absent any exploitation-probability data to elevate it.

A low-privileged authenticated XBoot user (e.g., a staff member scoped to a single department) iterates department IDs against the getByDepartmentId endpoint, which fails to enforce role-based data-scope filtering. They harvest usernames, real names, mobile numbers, emails, and account status for every department in the organization. No public exploit code is identified, though the referenced HackMD writeup documents the technique in detail.