CVE-2026-108888 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download all sys_depart_role records, including role names, codes, descriptions and creating users.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the web application framework. Specifically, this flaw resides in the SysDepartRoleController class, which is responsible for managing departmental roles and their associated metadata. The core issue lies in the exportXls handler method, which processes requests intended to generate Excel files containing role data. In a properly secured system, such operations should require elevated privileges or specific permissions tied to administrative functions. However, due to missing authorization checks, this endpoint is accessible to any user who has successfully authenticated to the application, regardless of their assigned role level. This design oversight effectively bypasses the principle of least privilege, allowing users with minimal default roles to perform actions that are typically reserved for system administrators or security managers.
From a technical perspective, the vulnerability exploits the lack of input validation regarding the caller's identity and permissions before executing sensitive data retrieval logic. When an authenticated user sends a request to the /sys/sysDepartRole/exportXls endpoint, the server processes this request without verifying whether the user possesses the necessary rights to view or export departmental role information. This absence of authorization middleware ensures that low-privileged attackers can interact with internal business logic directly through HTTP requests. The attacker does not need to exploit a separate injection flaw or bypass authentication; they simply utilize valid credentials obtained through standard login procedures, such as phishing or credential stuffing attacks, to access the restricted resource.
The operational impact of this vulnerability is significant due to the sensitivity of the data exposed. By successfully invoking the export function, an attacker can download comprehensive records from the sys_depart_role database table. This dataset includes role names, unique codes, detailed descriptions, and crucially, the identities of users who created these roles. The exposure of creator information provides attackers with a map of high-value targets within the organization, as creators are often system administrators or senior developers with broader access rights. Furthermore, understanding the structure and naming conventions of departmental roles aids in lateral movement planning, allowing attackers to better understand the organizational hierarchy and identify potential entry points for further escalation. This scenario aligns directly with CWE-269, which classifies Improper Privilege Management, as well as CWE-862, Missing Authorization, highlighting a fundamental breakdown in enforcing access control policies.
In terms of threat modeling, this vulnerability facilitates unauthorized data exfiltration and reconnaissance activities consistent with the MITRE ATT&CK framework's T1078 Valid Accounts technique, where attackers use legitimate credentials to gain initial access or maintain persistence. Additionally, the ability to export structured role data supports T1069 Permission Groups Discovery, enabling adversaries to map out security boundaries within the target environment. The combination of these capabilities significantly lowers the barrier for subsequent attacks, such as privilege escalation or targeted phishing campaigns against identified administrators.
To mitigate this vulnerability, immediate action is required on both technical and procedural fronts. Developers must implement robust authorization checks within the SysDepartRoleController's exportXls method to ensure that only users with specific administrative roles can execute data exports. This involves verifying user permissions against a defined access control list before processing any request for sensitive resources. Additionally, implementing role-based access control (RBAC) policies strictly at the API level is essential to prevent unauthorized endpoints from being reachable by lower-privileged accounts. Security teams should also conduct regular code reviews focusing on authorization logic and employ static application security testing tools configured to detect missing permission checks in controller methods. Regular penetration testing that includes scenarios for privilege escalation and data exfiltration will help identify similar gaps before they can be exploited in production environments.