EUVD-2026-97047
GHSA-693q-v8jj-pg4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitSend PUT /sys/user/doUpdateDepartInfo with foreign department id
-
ImpactRe-parent/rename department and alter department heads
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the target JeecgBoot instance at any privilege level, including a low-privileged account (PR:L) - self-registration or any basic user role is sufficient. No non-default configuration, feature flag, or user interaction is needed: the PUT /sys/user/doUpdateDepartInfo endpoint simply omits ownership and tenant authorization checks, so any logged-in user can act on any department id. The primary limiting factor is the authentication requirement; this cannot be exploited by fully unauthenticated remote attackers, and impact is confined to department metadata integrity (rename, re-parent, department-head changes) rather than data disclosure or service disruption. |
| Impact | This is a genuine but moderate-severity access-control flaw, not a drive-by critical. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms it is network-reachable and low-complexity, but PR:L means the attacker must already hold a valid low-privileged account on the JeecgBoot instance, which meaningfully narrows the threat to insiders or attackers who have obtained/registered credentials. Impact is scoped to integrity only (VI:L; VC:N, VA:N), consistent with CWE-862 missing authorization: an attacker can tamper with department records but cannot read sensitive data or deny service through this specific endpoint. Publicly available exploit code exists (a Python POC on GitHub), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability - treat exploitation likelihood as unestablished rather than high. No SSVC decision data was provided. Net: prioritize patching for multi-tenant or large-org JeecgBoot deployments where cross-tenant/cross-department integrity matters, but this does not warrant emergency out-of-band response on CVSS or POC alone. |
| Exploit ScenarioDerived | A user with a low-privileged JeecgBoot account (e.g., a self-registered or basic staff login) sends a crafted PUT request to /sys/user/doUpdateDepartInfo specifying a department id they do not own. Because the endpoint performs no ownership or tenant authorization check, they rename or re-parent that department and replace or remove its assigned department heads, corrupting organizational data potentially across other tenants. A public Python POC for this exact endpoint is available, lowering the skill required to weaponize it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user, including one holding only a basic low-privileged role, to rename, re-parent, or strip the department heads from any department via a PUT request to /sys/user/doUpdateDepartInfo. The endpoint applies no ownership or tenant checks, so an attacker with a valid session - obtainable through self-registration or any default user role - can tamper with organizational structure across tenants without any elevated privilege. Publicly available exploit code exists (a Python PoC published on GitHub), and the vendor has not released a confirmed fixed version at time of analysis; the flaw is rated moderate (CVSS 3.1 base 5.3, integrity-only impact) and there is no public evidence of active exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary remediation is to backport the authorization check yourself: add ownership and tenant-scope validation to the doUpdateDepartInfo handler in SysUserController (vulnerable region visible at https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L1996-L2000), rejecting any department id whose tenant or owning organization does not match the caller's session; rebuild and redeploy the jeecg-system-biz module, noting that this is a custom fork change you must maintain across upgrades. As an interim compensating control, restrict PUT /sys/user/doUpdateDepartInfo at the reverse proxy or API gateway so that only administrative roles or trusted internal networks can reach it - this blocks exploitation but will also break legitimate department administration from ordinary management accounts until the code fix lands. Additionally, disable open self-registration and review any default low-privilege roles that grant the department-management menu, since the vulnerability is only reachable by a logged-in user; audit application logs for unexpected POST/PUT calls to /sys/user/doUpdateDepartInfo and compare department trees against known-good backups, using the PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_user_update_depart_info.py to reproduce and regression-test the fix. Track the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-doupdatedepartinfo for a vendor-patched release and upgrade as soon as one ships.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform (Java, MyBatis, Vue front end) widely deployed for enterprise information systems, and its multi-tenant design depends on per-request department/tenant scoping to isolate one organization's data from another's. CVE-2026-108873 is CWE-862 (Missing Authorization): the handler for PUT /sys/user/doUpdateDepartInfo in SysUserController (the vulnerable region is referenced in the vendor source at lines 1996-2000 of jeecg-system-biz) accepts an attacker-supplied department id and applies rename, re-parent, and department-head replacement/removal operations without validating that the caller owns or belongs to that department, or that the department falls inside the caller's tenant. Because the check is simply absent rather than misconfigured, the control cannot be bypassed with crafted input - it must be added to the code path. The impact class is integrity-only (modified department metadata) with no confidentiality or availability effect per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N; the v4.0 vector supplied in the feed (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) agrees on the low-privilege, network-reachable, integrity-limited profile.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint callable by any low-privileged authenticated user (PR:L, AC:L, UI:N); only limited integrity impact to department records, with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads without ownership or tenant checks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB