JeecgBoot Missing Authorization in Department Head Assignment

Executive Summary

CVE-2026-108874 is a missing authorization vulnerability in JeecgBoot versions up to 3.9.5. It allows any authenticated user to assign or remove department head roles by calling the PUT endpoint /sys/user/changeDepartChargePerson without proper permission checks. Attackers can supply arbitrary user IDs, department IDs, and status values to either promote any user to department head or demote existing heads.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PUT requests to /sys/user/changeDepartChargePerson by monitoring server logs for requests with userId, departId, and status parameters. Use tools like curl to test the endpoint: curl -X PUT -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"userId":"<target_id>","departId":"<dept_id>","status":true}' <target_url>/sys/user/changeDepartChargePerson. Verify if the request succeeds without proper permissions.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers can exploit this to gain elevated access within departments. By appointing themselves or others as department heads, they can view sensitive department-scoped data or perform unauthorized actions. This could lead to data breaches, unauthorized modifications, or privilege escalation within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data. Unauthorized elevation of privileges may lead to data exposure, unauthorized processing, or breaches of confidentiality, resulting in potential legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to a version beyond 3.9.5 where the vulnerability is patched. Implement role-based access control by adding @RequiresPermissions annotations to the /sys/user/changeDepartChargePerson endpoint. Restrict PUT requests to authorized users only and audit user permissions regularly.

Useful 0 Not Useful 0