EUVD-2026-96579
GHSA-j46f-xgm7-j2hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JeecgBoot account
-
ExploitSend GET /sys/sysDepartRole/queryById with arbitrary id
-
ExecutionMissing Shiro authorization check bypassed
-
ImpactRead out-of-scope department role data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated JeecgBoot session (PR:L) and network access to the /sys/sysDepartRole/queryById endpoint; the attacker simply supplies an arbitrary id value. The specific precondition is that the queryById handler in SysDepartRoleController is missing its Shiro @RequiresPermissions annotation, so any logged-in user - regardless of department scope - can read records. Limiting factors: an account is needed (so not exploitable by fully unauthenticated outsiders), impact is read-only disclosure of department role metadata (names, codes, descriptions, audit fields) with no write or availability effect, and exposure depends on the JeecgBoot system API being reachable by non-admin users. |
| Impact | This is a genuine but low-severity information-disclosure issue, correctly scored CVSS 4.0 5.3 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N is internally consistent with the description: network-reachable (AV:N), low complexity with no special attack requirements (AC:L/AT:N), and requiring an existing low-privileged authenticated account (PR:L) - this is an insecure-direct-object / missing-authorization flaw (CWE-862), not an unauthenticated breach. Impact is limited to confidentiality of a narrow data set (VC:L only; department role names, codes, descriptions, audit fields) with no integrity or availability impact, which is why severity stays Medium despite the easy network vector. Publicly available POC code (VulnCheck advisory plus a GitHub exploit script) raises practical exploitability and lowers the barrier to opportunistic abuse, but the CVE is NOT listed in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. Net: a real, confirmable issue worth patching in JeecgBoot deployments that expose the admin API to multiple user tiers, but not an emergency relative to unauthenticated RCE-class bugs. |
| Exploit ScenarioDerived | A low-privileged authenticated user (e.g. an ordinary operator account) sends GET /sys/sysDepartRole/queryById?id=<arbitrary_id> and receives department role records they were never authorized to view, because the handler lacks the Shiro permission annotation. A public POC script (poc_org_scope_reads.py) automates this enumeration across organizational scope, allowing harvesting of role metadata outside the attacker's assigned department. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in the JeecgBoot SysDepartRole queryById handler (all versions through 3.9.5) lets any authenticated user - regardless of department scope - read department-role metadata such as role names, codes, descriptions, and audit fields by issuing GET /sys/sysDepartRole/queryById with an arbitrary id value. Exploitation requires only a valid low-privileged session on a reachable JeecgBoot system API, so it is not exploitable by fully unauthenticated outsiders, and publicly available exploit code exists, making the flaw trivially reproducible for anyone holding basic account credentials. The impact is limited to read-only disclosure of role metadata with no write or availability effect, consistent with the assessed CVSS 4.0 score of 5.3 (Medium) and CWE-862 (Missing Authorization).
RemediationAI
No vendor-released patch was identified at time of analysis; the provided CVE references point to the vulnerable source lines and the VulnCheck advisory rather than to a fixed release, commit, or pull request, so no exact patched version can be cited. The most direct fix is to add the appropriate Shiro permission annotation (for example @RequiresPermissions on the queryById method) in SysDepartRoleController so the endpoint enforces the same department-role permission required by sibling handlers, then rebuild and redeploy the jeecg-system-biz module; as a stopgap, administrators can restrict access to /sys/sysDepartRole/queryById at the reverse proxy, API gateway, or WAF so that only trusted administrative roles or internal networks can reach it, accepting that legitimate low-privileged UI flows depending on that route may break. Additional compensating controls with their trade-offs include narrowing the roles permitted to authenticate against the system API (reduces exposure but may lock out business users), adding server-side scope validation in the handler to verify the requesting user is entitled to the requested department role (requires custom code maintenance), and monitoring or alerting on GET requests to /sys/sysDepartRole/queryById containing unusual or sequential id values (detects enumeration but does not prevent it). Because the weakness is read-only metadata disclosure requiring a valid low-privileged account, credential hygiene and prompt revocation of unnecessary accounts meaningfully reduce the attack surface until an upstream fix is available; validated guidance should be tracked through the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartrole-querybyid.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module secures controller endpoints with Apache Shiro permission annotations, typically @RequiresPermissions, enforced through the Shiro filter chain. The vulnerable handler is SysDepartRoleController.queryById, located at lines 170-175 of SysDepartRoleController.java in the jeecg-system-biz module, which was shipped without its Shiro authorization annotation. Because the endpoint relies solely on the authenticated-session requirement rather than a role/permission check, any logged-in user - including one whose department scope should exclude the target record - can reach the underlying department-role query by supplying an arbitrary id, and the backing persistence layer performs no ownership or scope filtering on the returned row. The root cause maps to CWE-862 (Missing Authorization): the class of bug in which an access-control decision is simply absent rather than implemented incorrectly. The affected CPE is cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*, i.e., the product line up to and including 3.9.5, and the vulnerability is a network-reachable (AV:N), low-complexity (AC:L) information-disclosure bug requiring low privileges (PR:L), matching the reported CVSS 4.0 vector and the assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-privileged user over the network (PR:L, AV:N, AC:L) exploits a missing authz check for read-only disclosure of limited data, so C:L with I/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB