CVE-2026-108628

Summary

JeecgBoot 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint that allows any authenticated user to modify department role permissions. This flaw enables low-privileged attackers to grant arbitrary menu or button permissions, potentially escalating their privileges or revoking other users' permissions.

Exploitability

The vulnerability is easily exploitable by any authenticated user who can submit roleId and permissionIds values to the saveDeptRolePermission endpoint, requiring no special prerequisites beyond basic authentication.

Blast radius

The impact could be significant as attackers could elevate their privileges or revoke permissions from other users, potentially compromising multiple accounts and system access controls.

Detection

Monitor for unauthorized calls to the /sysDepartPermission/saveDeptRolePermission endpoint with unusual roleId and permissionIds parameter combinations in application logs, particularly from low-privilege user accounts.

Prioritized remediation

Upgrade to JeecgBoot 3.9.6 or later to address this missing authorization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.