EUVD-2026-96571
GHSA-m469-3qff-fv5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any low-privileged account
-
DeliveryAuthenticate to JeecgBoot
-
ExploitSend GET /sys/sysDepartPermission/queryById with arbitrary ids
-
ExecutionServer skips authorization check
-
ImpactHarvest depart_id, permission_id, data_rule_ids
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the target JeecgBoot instance (CVSS PR:L - any low-privileged user suffices; no admin role needed). The specific vulnerable endpoint is the SysDepartPermissionController queryById handler reached via GET /sys/sysDepartPermission/queryById with an attacker-chosen id. No user interaction, no special non-default configuration, and no particular platform is required - the missing authorization check appears to be present in the default code path through version 3.9.5. The practical limiting factor is account access: instances without untrusted/self-service accounts and not exposed to low-trust users face materially lower risk, and impact is confined to reading department permission metadata (no write/modify or availability effect). |
| Impact | This is a moderate-severity information-disclosure issue, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low privileges, with only limited confidentiality impact (VC:L) and no integrity or availability impact - consistent with the CWE-862 missing-authorization classification and the description of an IDOR-style read of department permission records. A public POC exists (reported by VulnCheck), which raises near-term opportunistic-scanning risk, but POC availability is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from this data. The key limiter is that exploitation requires a valid authenticated (low-privileged) account per PR:L - this is a privilege-escalation/over-read within an authenticated session, not an unauthenticated breach. Net: real but low-to-moderate priority; patch in normal cycles and prioritize if the instance is internet-exposed with self-registration or many low-trust users. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has obtained any valid account) sends GET /sys/sysDepartPermission/queryById iterating through arbitrary id values. Because the queryById handler performs no authorization check, the server returns depart_id, permission_id and data_rule_ids for departments the user has no rights to, enabling enumeration of the organization's permission structure. A public POC script (poc_depart_permission_query_by_id.py) already automates this request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Low-privileged authenticated users of JeecgBoot through 3.9.5 can read department permission records they should not be authorized to see by issuing GET requests to /sys/sysDepartPermission/queryById with an arbitrary department id, exposing depart_id, permission_id and data_rule_ids values. The flaw is a missing authorization check in the SysDepartPermissionController queryById handler (CWE-862), rated 5.3 with an assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so exploitation is limited to confidentiality impact and requires only a valid account with no administrative role. Publicly available exploit code exists (a Python PoC published by VulnCheck-referenced researchers), and the issue is not listed in CISA KEV as actively exploited; EPSS data was not provided, so no exploitation-likelihood estimate can be cited.
RemediationAI
No vendor-released patch was identified in the available data for the endpoint described, so defenders should plan to upgrade to the first JeecgBoot release published after 3.9.5 once the maintainers ship an authorization fix, and should track the upstream repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-querybyid-endpoint) for the fixed version number rather than assuming one exists. Until then, the most effective compensating control is to block or tightly restrict GET /sys/sysDepartPermission/queryById at the reverse proxy, API gateway or WAF, allowing it only from trusted administrative networks or service accounts - the trade-off is that any legitimate administrative UI relying on that endpoint from the blocked networks will break, so scope the rule by source IP or role where possible. A source-level fix is straightforward for teams that maintain a fork: add an authorization/data-scope check (for example @RequiresPermissions or an explicit role and depart-scope validation) in the queryById handler around the referenced lines before returning the record. Finally, reduce the attack surface by disabling self-registration and removing or disabling unused low-privileged accounts on internet-exposed instances, since the flaw requires only a valid authenticated session, and monitor access logs for enumeration patterns (many sequential ids requested against /sys/sysDepartPermission/queryById from a single principal) to detect abuse - a monitoring control that provides detection but does not prevent the disclosure itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source low-code development platform built on Spring Boot and MyBatis that ships a large system module (jeecg-system-biz) with REST controllers for users, roles, departments and permissions. The vulnerable component is SysDepartPermissionController, whose queryById handler is mapped to GET /sys/sysDepartPermission/queryById and accepts a caller-supplied id. The handler performs a lookup and returns the matching SysDepartPermission record - including the depart_id, permission_id and data_rule_ids fields - without verifying that the requesting principal is authorized to view that department's permission mapping. This is a classic CWE-862 (Missing Authorization) defect: authentication is enforced by the framework's session/token filter, but the per-object (or per-endpoint) authorization check is absent, so any valid session can enumerate identifiers and read cross-department permission metadata. The referenced upstream source lines (SysDepartPermissionController.java L144-L149 in commit e3b9dc0) correspond to this handler, and the CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates all released versions up to and including 3.9.5 are affected because the default code path contains no role or data-scope gate.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N), trivial request (AC:L), requires any authenticated user (PR:L), no UI; only partial confidentiality of permission metadata (C:L), no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB