CVE-2026-108629 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the enterprise application framework's administrative module. Specifically, the flaw resides in the saveDatarule handler of the SysDepartPermissionController class. This component is responsible for managing data permission rules that dictate which users or roles can access specific datasets based on departmental hierarchies and menu permissions. The core technical deficiency is a missing authorization check at the controller level, meaning the application fails to verify whether the authenticated user initiating the request possesses the necessary administrative privileges to modify these sensitive security configurations. Consequently, any user who has successfully authenticated to the system, regardless of their assigned role or privilege level, can interact with this endpoint without restriction.
From a technical perspective, the exploitation vector involves sending an HTTP POST request to the /sys/sysDepartPermission/datarule endpoint. The attacker supplies specific parameters including departId, permissionId, and dataRuleIds. By manipulating these inputs, an unauthorized user can alter the underlying logic that governs data visibility across the application. This capability allows the attacker to add new data rules that grant themselves or other low-privileged accounts access to restricted information, modify existing rules to broaden scope, or clear established restrictions entirely. Because this endpoint controls foundational security boundaries within the JeecgBoot architecture, compromising it effectively undermines the integrity of the entire authorization model for departmental data.
The operational impact of this vulnerability is severe and multifaceted. In a typical deployment where multiple departments handle sensitive corporate information such as financial records, human resources data, or proprietary project details, an attacker with low-level access can escalate their privileges by manipulating these rules. They could potentially view data belonging to other departments that should be strictly isolated from them. Furthermore, the ability to clear existing rules might lead to a denial of service for legitimate users who rely on those restrictions for compliance or operational reasons. This scenario aligns directly with CWE-284 Improper Access Control and CWE-862 Missing Authorization, highlighting a fundamental breakdown in enforcing least privilege principles.
In terms of threat modeling and industry frameworks, this vulnerability maps to the MITRE ATT&CK technique T1078 Valid Accounts, as it relies on valid authentication credentials, combined with T1098 Account Manipulation if used to persist access or expand privileges through rule modification. It also reflects aspects of privilege escalation where a user leverages an application flaw to gain capabilities beyond their intended scope. The lack of server-side validation for the requester's role against the target department creates a direct path for unauthorized data exfiltration and integrity compromise, posing significant risks to confidentiality and trust within multi-tenant or hierarchical organizational structures utilizing JeecgBoot.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves implementing robust server-side authorization checks within the saveDatarule handler in SysDepartPermissionController. Developers should ensure that only users with specific administrative roles, such as system administrators or department heads depending on business logic, are permitted to invoke this endpoint. Additionally, input validation must be strengthened to verify that a user can only modify rules for departments they legitimately manage, preventing cross-departmental manipulation. Upgrading to a patched version of JeecgBoot where these access controls have been enforced is the most effective immediate solution. For organizations unable to upgrade immediately, implementing an API gateway or WAF rule to restrict access to this specific endpoint based on user role headers can provide temporary protection against exploitation while permanent code fixes are deployed.