| 제목 | JeecgBoot 3.9.1 Improper Access Controls |
|---|
| 설명 | The PUT /sys/selectDepart endpoint binds a full SysUser entity from the request body and directly persists the client-supplied orgCode and loginTenantId to the database without any server-side validation—no permission annotation,no department membership check, no tenant ownership verification. Any authenticated user, including those with only the default test role, can set these fields to arbitrary values, effectively switching their session context to any department or tenant in the system. When chained with the userEdit self-escalation, an attacker who switches into a target department's context and elevates their userIdentity to 2 with departIds pointed at that department can then query its complete member list via departUserList, gaining visibility into organizational data they have nolegitimate access to. The impact is that the department and tenant boundaries—JeecgBoot's primary data isolation mechanism—can be crossed at will by any logged-in user in two requests, with no administrative privileges required. |
|---|
| 원천 | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9597 |
|---|
| 사용자 | AliceS614 (UID 94277) |
|---|
| 제출 | 2026. 05. 02. AM 11:40 (5 개월 ago) |
|---|
| 모더레이션 | 2026. 05. 26. PM 02:50 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 365636 [JeecgBoot 까지 3.9.1 /sys/selectDepart LoginController.selectDepart 권한 상승] |
|---|
| 포인트들 | 20 |
|---|