CVE-2026-108628 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5, specifically affecting the SysDepartPermissionController component. This vulnerability is classified as a missing authorization issue, which fundamentally represents an access control failure where the application does not adequately verify whether the authenticated user has the necessary privileges to perform the requested action on specific resources. The affected endpoint, saveDeptRolePermission, is designed to manage permissions associated with departmental roles, but it lacks sufficient server-side validation of the requester's identity and role hierarchy relative to the target resource. This architectural oversight allows any authenticated user, regardless of their actual privilege level within the system, to interact directly with this API endpoint without being blocked by an authorization check that would normally restrict such operations to administrators or users with specific management rights.
From a technical perspective, the vulnerability stems from the controller's failure to enforce role-based access control policies before processing input data. When a user submits a request containing roleId and permissionIds parameters, the backend logic proceeds to update the database records linking these roles to the specified permissions without verifying if the submitting user owns or has administrative authority over that particular department or role structure. This lack of object-level authorization means that an attacker can manipulate the state of other users' access rights by simply crafting HTTP requests with arbitrary identifiers. The absence of checks such as ensuring the requester is a super administrator, belongs to the same organizational unit, or holds a specific permission management role creates a direct path for privilege escalation and unauthorized configuration changes.
The operational impact of this vulnerability is significant, primarily centering on the compromise of integrity and confidentiality within the application's security model. Low-privileged attackers can exploit this flaw to grant themselves arbitrary menu access or button-level permissions that were not originally assigned, effectively escalating their privileges to match those of higher-ranking users such as system administrators. This escalation enables further malicious activities including data exfiltration, modification of critical business logic, or complete takeover of the application interface. Conversely, attackers can also revoke permissions from other legitimate users, leading to denial of service for specific functionalities and disrupting normal business operations by locking out authorized personnel from necessary tools and dashboards.
This vulnerability aligns with CWE-285 Improper Authorization, which describes scenarios where an actor is able to access resources or perform actions that are outside their intended privileges. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, as it relies on existing authenticated credentials, and potentially T1068 Exploitation for Privilege Escalation if the attacker uses the gained permissions to access higher-level system components. The ability to modify role-permission mappings also touches upon configuration changes that can facilitate lateral movement or persistence within a compromised environment.
To mitigate this vulnerability, immediate remediation should focus on implementing robust server-side authorization checks at the controller level for the saveDeptRolePermission endpoint. Developers must ensure that every request validates not only the authentication token but also verifies that the authenticated user possesses explicit administrative rights over the specific department and role being modified. This can be achieved by integrating a centralized access control mechanism or annotation-based security framework, such as Spring Security with custom method-level security expressions, to enforce checks before any business logic is executed. Additionally, implementing principle of least privilege in the application design ensures that default permissions are restrictive and only granted when explicitly verified. Regular code reviews focusing on authorization logic and automated penetration testing can help identify similar gaps in other endpoints where resource ownership or role hierarchy validation might be missing.