CVE-2026-108636 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified vulnerability resides within the JeecgBoot framework, specifically affecting versions up through 3.9.5, and centers on a critical failure in access control mechanisms within the SysDepartController component. The core technical flaw is located in the appImportExcel handler method, which processes Excel file uploads for department management purposes. This endpoint fails to enforce sufficient authorization checks before executing the import logic, allowing any authenticated user with valid credentials to interact with it regardless of their assigned role or privilege level. In a properly secured application architecture, operations that modify administrative data structures such as organizational hierarchies should be restricted exclusively to users possessing specific high-privilege roles like system administrators. The absence of these checks means the security boundary intended to separate standard user actions from administrative functions is effectively bypassed by any logged-in entity.
From a technical perspective, this vulnerability enables low-privileged attackers to exploit the application's data import functionality to inject arbitrary records into the sys_depart database table. By crafting and uploading a malicious Excel workbook containing predefined department structures, an attacker can manipulate the internal state of the system without triggering appropriate permission validations. The POST request directed at /sys/sysDepart/appImportExcel serves as the vector for this exploitation, where the server blindly trusts the input data structure provided by the client side after basic authentication verification. This lack of role-based access control validation allows the creation of new department nodes within the administrator-maintained tree, effectively altering the organizational schema defined by system administrators. The impact extends beyond simple data modification as it compromises the integrity of the application's foundational identity and access management structure.
The operational impact of this vulnerability is significant because it undermines the principle of least privilege central to secure software design. By allowing unauthorized creation of department records, attackers can potentially establish persistent footholds within the system's logical hierarchy that may facilitate further lateral movement or privilege escalation attempts depending on how downstream modules interpret these new entities. For instance if subsequent features rely on this department tree for assigning permissions or viewing data scopes, an attacker could manipulate access controls indirectly by creating deceptive organizational units designed to trick other users or administrators into interacting with malicious content. This also represents a serious integrity violation as the administrative view of the organization becomes unreliable and potentially misleading for legitimate management personnel who depend on accurate structural information for decision-making processes.
This vulnerability aligns closely with CWE-269 which describes Improper Privilege Assignment, specifically highlighting scenarios where users are granted privileges they should not possess due to flawed logic in authorization checks. Furthermore it maps directly to MITRE ATT&CK technique T1078 Valid Accounts as the exploitation requires initial authentication but leverages insufficient role verification to perform actions outside normal user capabilities. The attack pattern resembles unauthorized resource modification often seen in web application frameworks where business logic layers fail to validate context before executing state-changing operations. To mitigate this risk organizations running affected versions must immediately upgrade JeecgBoot to a patched version that implements robust authorization checks within the SysDepartController appImportExcel handler. Until an update is applied administrators should restrict network access to this specific endpoint using web application firewalls or reverse proxy configurations and audit existing department records for any unauthorized additions resulting from prior exploitation attempts ensuring data integrity through manual verification of organizational structures against known baseline states.