CVE-2026-108629

Received Received - Intake

JeecgBoot Missing Authorization in SysDepartPermissionController

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108629

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController. This allows any authenticated user to modify department data rules without proper permission checks.

Detection Guidance

Check for unauthorized POST requests to /sys/sysDepartPermission/datarule with departId, permissionId, and dataRuleIds parameters. Monitor logs for unusual modifications to department data rules by low-privileged users.

Impact Analysis

Low-privileged attackers can exploit this to send requests to POST /sys/sysDepartPermission/datarule with departId, permissionId, and dataRuleIds parameters. This enables them to change, add, or clear data rules on any department-menu permission binding, potentially altering access controls.

Compliance Impact

This vulnerability could lead to unauthorized modifications of data access rules, potentially violating compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest JeecgBoot patch or update to version 3.9.5 or higher. Restrict access to the /sys/sysDepartPermission/datarule endpoint. Review and audit all data rule modifications for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-108629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70