JeecgBoot EUVD-2026-97045

Requires a valid low-privileged authenticated JeecgBoot account (PR:L) that can reach the SysDepartRole data-rule save endpoint (POST /sys/sysDepartRole/datarule per the advisory); the attacker must supply permissionId, roleId and dataRuleIds targeting a department role they do not legitimately administer. No user interaction, no special non-default configuration, and no elevated privileges are needed beyond ordinary authenticated access. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, and impact is confined to row-level data-rule scope manipulation (data access/filtering) rather than code execution or full account takeover, so realistic risk is highest where low-privileged accounts are widely issued or self-registration is enabled.

This is a genuine but moderate-severity access-control flaw, not a drop-everything emergency. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CWE-862 (Missing Authorization) classification agree internally: a network-reachable, low-complexity request that requires only low-privileged authentication (PR:L), with low impact to confidentiality and integrity and no availability impact (VC:L/VI:L/VA:N), yielding 5.3 (Medium). The description is consistent with this - exploitation widens or alters row-level data-rule filtering rather than granting full takeover, so the real-world blast radius is bounded. Exploitation signals: a public POC exists (VulnCheck-referenced GitHub script), which raises practical risk since a working request template is available, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The POC availability and active exploitation are distinct signals and must not be conflated. Net: prioritize for patching in internet-exposed or multi-tenant JeecgBoot deployments where low-privileged accounts are broadly provisioned, but it ranks below unauthenticated RCE-class issues. No major internal conflicts in the data; the main gap is the absence of EPSS/KEV telemetry to gauge exploitation likelihood.

A low-privileged authenticated JeecgBoot user (e.g., an ordinary department operator) sends a crafted POST to the SysDepartRole data-rule save endpoint with attacker-chosen permissionId, roleId and dataRuleIds values. Because the saveDatarule handler fails to verify the caller is authorized over the target department role, the request overwrites data_rule_ids for roles the user should not control, widening that role's row-level data visibility or weakening its filtering. A public POC script (poc_depart_role_datarule_write.py) demonstrating this request is available.