CVE-2026-108635 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the enterprise application framework. Specifically, the GET /sys/sysDepart/getDepartmentHead endpoint located in the SysDepartController class lacks proper authorization checks for authenticated users who do not possess administrative privileges or specific role-based permissions required to view sensitive organizational data. This missing function level access control flaw allows any user with a valid account on the system to query departmental structures and retrieve detailed personnel information that should be restricted based on their security clearance levels. The absence of server-side validation ensures that the application processes requests from unauthorized actors without verifying whether they have the right to view the requested resources, thereby exposing internal organizational hierarchies and personal data to exploitation by any logged-in user regardless of their intended role within the organization.
From a technical perspective, this vulnerability stems directly from CWE-285 Improper Authorization, where the application fails to enforce proper access controls when an authenticated user attempts to access a protected resource. The attacker can leverage this flaw through simple HTTP GET requests, manipulating parameters such as departId to enumerate valid department identifiers and subsequently extract associated staff details. This capability transforms what might appear as a minor information disclosure into a significant reconnaissance vector for further attacks. By systematically iterating through potential department IDs, an adversary can build a comprehensive map of the organization's structure, identifying key personnel, their roles, and contact methods including mobile numbers and telephone lines that were explicitly marked as hidden or private by administrators. This level of detail facilitates social engineering campaigns, targeted phishing attempts known as spear-phishing, and potentially physical security breaches if location data is inferred from departmental locations.
The operational impact of this vulnerability extends beyond mere privacy violations to include severe risks to organizational integrity and compliance with data protection regulations such as GDPR or CCPA. The exposure of personally identifiable information including names, avatars, job titles, and direct contact details creates a rich dataset for malicious actors seeking to compromise individual accounts through credential stuffing or password spraying attacks if those contacts are also used in other systems. Furthermore, the ability to map out departmental hierarchies aids attackers in identifying high-value targets such as executives or IT administrators who may have elevated privileges within the system. This contextual awareness significantly lowers the barrier for subsequent exploitation phases including privilege escalation and lateral movement within the network infrastructure protected by JeecgBoot applications.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing robust role-based access control checks at the controller level before processing any requests to the getDepartmentHead endpoint. Developers must ensure that only users with specific administrative roles or explicit permissions designated for viewing organizational charts are allowed to execute these queries. Additionally, input validation and parameterized queries should be employed to prevent enumeration attacks by limiting the scope of returned data based on the requester's actual departmental affiliation rather than allowing unrestricted access across all departments. Regular security audits and penetration testing focusing on broken object level authorization flaws will help identify similar weaknesses in other endpoints within the framework. Updating JeecgBoot to a patched version that addresses this specific authorization gap is essential for restoring secure operational standards and protecting sensitive employee data from unauthorized exposure.