Missing Authorization in JeecgBoot Allows Department Modification

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability (CVE-2026-108873) that allows low-privileged authenticated users to modify any department by sending a PUT request to the endpoint /sys/user/doUpdateDepartInfo. Attackers can exploit this by providing a department ID to rename or re-parent the department, or replace or remove its department heads without performing ownership or tenant checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PUT requests to /sys/user/doUpdateDepartInfo endpoint in JeecgBoot logs. Monitor for unexpected department modifications or changes in department hierarchy.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to rename departments, change parent departments, and modify department heads without proper authorization. This could lead to unauthorized access, privilege escalation, or disruption of organizational structure within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to modify department structures and personnel without proper authorization checks. Unauthorized changes to department data may lead to improper access controls, data integrity issues, or unauthorized access to sensitive information, which are critical concerns under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to a version beyond 3.9.5. Implement strict role-based access control and ensure proper authorization checks on all endpoints. Review and restrict permissions for low-privileged users.

Useful 0 Not Useful 0