CVE-2026-108640 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5, specifically affecting the SysDepartRoleController component. This vulnerability stems from a critical implementation error where the queryById handler method fails to enforce proper access control mechanisms via Apache Shiro permission annotations. In secure enterprise applications, controllers handling sensitive administrative data must explicitly define which roles or permissions are required for each endpoint. The absence of these annotations means that the framework does not automatically validate whether the requesting user possesses the necessary privileges before processing the request. This oversight creates a direct path for unauthorized access to internal system configuration data that should be restricted to high-privilege administrators only.
From an operational perspective, this missing authorization vulnerability allows low-privileged authenticated users to exploit the endpoint by sending GET requests to /sys/sysDepartRole/queryById with arbitrary identifiers. By manipulating the id parameter in these HTTP requests, attackers can retrieve detailed information about department roles across the system. The exposed data includes role names, unique codes, descriptive metadata, and various audit fields such as creation timestamps or modification history. This leakage of structural configuration details provides adversaries with valuable intelligence regarding the organization's internal hierarchy and access control model. Such information is often used in subsequent phases of an attack to map out privilege escalation paths or identify high-value targets within the application architecture.
The technical classification of this issue aligns directly with CWE-285, which describes Improper Authorization vulnerabilities where a user is able to access resources for which they should not have permission. Furthermore, from the perspective of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially aids in reconnaissance activities by allowing attackers to gather information about system structure without triggering typical intrusion detection alerts associated with brute-force or injection attacks. The vulnerability highlights a common pitfall in web application development where developers assume that authentication alone is sufficient for security, neglecting the necessity of granular authorization checks on every sensitive endpoint.
To mitigate this risk, immediate remediation requires adding appropriate Shiro permission annotations to the queryById method within SysDepartRoleController. Developers should specify which administrative roles are authorized to execute this operation, ensuring that only users with those specific privileges can successfully invoke the handler. Additionally, implementing a centralized authorization filter or interceptor for all controller methods handling sensitive data can provide defense in depth against similar oversights. Regular security code reviews focusing on access control logic and automated static analysis tools configured to detect missing permission annotations are recommended practices to prevent recurrence of such vulnerabilities in future development cycles.