EUVD-2026-97044
GHSA-898h-4prp-w6gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend crafted POST to sys/role saveDatarule
-
ExploitOverwrite role data_rule_ids bypassing authorization check
-
ExecutionClear row-level data filters
-
ImpactAccess widened record set
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session for a low-privileged JeecgBoot account (PR:L) and network reachability to the application's sys/role saveDatarule endpoint; no user interaction and no special non-default configuration are indicated. The attacker must be able to supply permissionId, roleId and dataRuleIds parameters. The principal limiting factor is the authentication requirement - exploitation is impossible for a fully unauthenticated outsider, so risk concentrates on instances that issue low-trust accounts or are exposed to many users; impact is bounded to data-rule/row-level filter manipulation (LOW confidentiality and integrity), not full compromise. |
| Impact | This is a genuine but moderate-priority authorization flaw, not a critical remote-code issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requiring existing low-privileged authentication (PR:L) and yielding only LOW confidentiality and integrity impact with no availability impact. A public PoC exists (VulnCheck-reported, github-poc reference), which raises practical exploitability above a theoretical finding, but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat the PoC as a capability signal, not an in-the-wild one. The signals are mutually consistent (no conflict between vector and description): all point to a post-authentication horizontal privilege/access-control weakness rather than a pre-auth breach. The real risk is elevated specifically for internet-exposed JeecgBoot instances that grant low-trust user accounts, where an attacker can quietly weaken row-level data filtering; it is lower for instances where all authenticated users are already trusted. No EPSS data was provided, so exploitation-probability modeling is unavailable and this assessment relies on PoC existence plus the CVSS vector. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has phished/obtained any valid low-trust account) sends a crafted POST to the sys/role saveDatarule endpoint supplying permissionId, roleId and dataRuleIds. Because the SysRoleController handler fails to verify the caller's authorization, the request overwrites the data_rule_ids for a targeted role, clearing row-level filters so previously restricted records become readable. A public Python PoC (poc_role_datarule_write.py) demonstrating this request is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
An authorization weakness in JeecgBoot through 3.9.5 lets any authenticated low-privileged user overwrite role-level data rules through the SysRoleController saveDatarule handler, clearing row-level filters so records normally hidden from that role become readable, or changing the filtering applied to other roles. Exploitation requires network reachability to the saveDatarule endpoint and a valid low-privileged session (PR:L) with no user interaction, and publicly available exploit code exists in the form of a Python PoC (poc_role_datarule_write.py) that posts permissionId, roleId and dataRuleIds values. Impact is bounded to data-rule and row-level filter manipulation with low confidentiality and integrity loss rather than code execution or administrative takeover, giving a moderate assessed severity (CVSS 3.1 5.3); risk concentrates on deployments that issue low-trust accounts or expose the application to many users.
RemediationAI
No vendor-released patch or exact fixed version is identified in the available data, so remediation must begin with compensating controls on the saveDatarule endpoint (POST sys/role/datarule) until an official fix is confirmed. Server-side enforcement is the correct fix: add an explicit permission check in SysRoleController.saveDatarule so that only callers holding data-rule/role administration privileges may pass permissionId, roleId and dataRuleIds, and reject requests that target roles outside the caller's scope; this closes the root cause but requires a code change and a redeploy. Short-term, restrict the endpoint at the perimeter (reverse proxy, API gateway or WAF) so that only trusted administrative networks or accounts can reach sys/role/*/datarule, accepting that legitimate administrative workflows outside those networks will break. If row-level data rules are not actively used by the deployment, disabling the data-rule feature removes the attack surface entirely, at the cost of losing row-level access segmentation. Audit existing data_rule_ids values for unauthorized or emptied entries and review application logs for POSTs to the saveDatarule handler from low-privileged accounts, since clearing those rows silently widens what a role can read. Track the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-post-sys-role-datarule) and the upstream repository for a patched release, and treat the referenced source file as the location to verify any fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is JeecgBoot, a Spring Boot based low-code development platform whose system module exposes SysRoleController in jeecg-module-system. The flaw is classified as CWE-862 (Missing Authorization): the saveDatarule handler referenced in the public source (lines 475-500 of SysRoleController.java) accepts caller-supplied permissionId, roleId and dataRuleIds parameters and persists them into the data_rule_ids field without verifying that the requester actually holds authority to manage data rules for that role. Because JeecgBoot's data rules drive row-level filtering applied to queries (typically translated into SQL predicates through the MyBatis persistence layer), rewriting data_rule_ids effectively widens or narrows the record set visible to a given role, which is why the impact is scoped to confidentiality and integrity of filtered data rather than to the authentication mechanism itself. The provided CPE, cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*, uses a wildcard version and is consistent with the advisory's statement that all releases through 3.9.5 are affected, so no version boundary below 3.9.5 is established by the supplied data. Note that the tag 'Authentication Bypass' is a loose label here; the demonstrated issue is a missing authorization check on an already-authenticated endpoint, not a bypass of authentication.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity, but requires an existing low-privileged account (PR:L); impact limited to partial data exposure and filter tampering (C:L/I:L), no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level filters to widen readable records or altering filtering for other roles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB