CVE-2026-108632 in JeecgBoot
요약
\~에 의해 MITRE • 2026. 10. 11.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.