JeecgBoot EUVD-2026-97062

Exploitation requires a valid authenticated session on the target JeecgBoot instance, but only the default minimal/low-privileged role - no admin rights, no user interaction, and no non-default configuration are needed, as the /sys/sysDepartRole/exportXls handler simply omits the authorization check. Limiting factors: the attacker must first obtain or register an account (PR:L), so instances that do not expose self-registration or do not grant accounts to untrusted users materially reduce exposure; impact is confined to read-only disclosure of sys_depart_role data (role names, codes, descriptions, creating users) with no write or availability effect.

This is a genuine but low-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and accurately reflects the description: network-reachable, low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability impact. Publicly available exploit code exists (a Python POC on GitHub) and the issue was reported by a credible source (VulnCheck), which raises the practical likelihood of opportunistic use against exposed instances. However, there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active exploitation - this remains publicly-exploitable-but-not-confirmed-in-use. Net assessment: not a drop-everything emergency, but a legitimate patch priority for any JeecgBoot deployment that grants accounts to semi-trusted or self-registered users, because the PR:L barrier is weak and the data exposed (role names, codes, descriptions, creating users) is useful reconnaissance for privilege-escalation follow-on. No key signals conflict; the main gap is the absence of EPSS/KEV data, which prevents a widespread-exploitation claim.

A low-privileged user holding only the default minimal role (e.g. a self-registered or semi-trusted account) authenticates to a JeecgBoot instance and issues a GET/POST request to /sys/sysDepartRole/exportXls. Because the handler lacks an authorization check, the server returns an XLS export of all sys_depart_role records - role names, codes, descriptions and creating users - handing the attacker an organizational-permission map usable for targeted privilege-escalation. A public Python POC for this request already exists, lowering the skill barrier.