CVE-2026-108635 in JeecgBoot
요약
\~에 의해 MITRE • 2026. 10. 11.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.