CVE-2026-108874 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's administrative module. Specifically, this flaw resides in the endpoint PUT /sys/user/changeDepartChargePerson, which is designed to manage department leadership roles by assigning or removing individuals from positions of authority such as department heads. The core technical deficiency lies in the absence of proper authorization checks that verify whether the authenticated user initiating the request possesses the necessary privileges to modify these specific role assignments. In a secure implementation, this operation should be restricted exclusively to users with high-level administrative rights, typically those holding super-administrator or equivalent roles capable of managing organizational structures. However, due to the missing authorization logic, any validly authenticated session can invoke this API endpoint without restriction based on the caller's actual permission level.
This architectural oversight allows low-privileged attackers who have obtained legitimate credentials for a standard user account to manipulate departmental hierarchies at will. By supplying arbitrary values for userId, department id, and status parameters within the HTTP PUT request, an attacker can arbitrarily designate any existing user as a department head or strip current heads of their authority. This capability fundamentally undermines the principle of least privilege by enabling users with minimal access rights to escalate their influence over organizational data visibility and management workflows. The ability to change these roles is not limited to self-assignment; attackers can target other users, thereby expanding their own scope of control indirectly through compromised or colluding accounts within the targeted department structure.
The operational impact of this vulnerability extends beyond simple role manipulation, significantly affecting the confidentiality and integrity of data governed by department-scoped views. In many enterprise resource planning systems like JeecgBoot, access to sensitive business records is often filtered based on the user's current departmental affiliation or leadership status. By forcing a target user into a department head position, an attacker can potentially grant that user (and consequently any account they control) access to broader datasets previously restricted by their original lower-level role. Conversely, demoting existing heads can disrupt legitimate business operations and create opportunities for further exploitation if the vacated roles are not immediately reassigned or monitored. This manipulation of organizational structure effectively bypasses logical security controls that rely on hierarchical permissions to protect sensitive information assets.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining privileges they were not intended to have through the misuse of administrative functions. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to perform actions that are normally restricted to higher-privileged roles. The specific action of modifying user attributes and role assignments falls under privilege escalation via application logic flaws rather than traditional buffer overflows or injection attacks, highlighting the importance of securing business logic layers in addition to network perimeter defenses.
To mitigate this vulnerability, immediate remediation should focus on implementing robust server-side authorization checks for all administrative endpoints. Developers must ensure that every request to modify critical system configurations, such as department leadership assignments, is validated against a centralized access control list or role-based access control matrix before processing the change. It is essential to verify not only that the user is authenticated but also that their assigned roles explicitly permit modifications to organizational hierarchy data. Additionally, implementing strict input validation on parameters like userId and departmentId can prevent certain types of mass assignment attacks, although this should complement rather than replace proper authorization checks. Regular security audits focusing on business logic flaws and penetration testing by external experts are recommended to identify similar gaps in other administrative modules before they can be exploited in production environments.