JeecgBoot: Missing authorization in saveDeptRolePermission endpoint
Summary
JeecgBoot through version 3.9.5 contains a missing authorization check in the saveDeptRolePermission endpoint of SysDepartPermissionController. Any authenticated user, including a low-privileged one, can submit role and permission IDs to change department role permissions. An attacker can grant arbitrary menu or button permissions to roles, escalate privileges, or revoke other users' permissions. A public proof of concept exists, but no active exploitation has been reported.
Affected
- JeecgBoot 0 through 3.9.5 (vendor range per CVE record)
- Version 3.9.5 is in the affected range.
Fixed in
Unknown. No vendor advisory or confirmed patch found. Sources disagree on the fixed version; verify in the JeecgBoot GitHub repository.
Workaround
- Restrict access to the admin/system module by network (VPN, IP allowlist or reverse-proxy rules) so that only administrators can reach it.
- Audit department role permission mappings against a known-good baseline.
- Remove unused low-privileged accounts and limit the number of accounts.
Exploitation
- Public proof of concept: yes (linked in CVE references).
- Exploited in the wild: no report found.
- CISA SSVC: exploitation PoC, automatable no, technical impact total.
- EPSS: 0.00231.
Our recommendation
- Check whether JeecgBoot is in use and whether it is reachable from the internet.
- Apply network restrictions to the admin module until a verified fix is installed.
- Review department role permissions and recent changes for unexpected grants.
- Monitor logs for calls to saveDeptRolePermission from non-admin accounts.
- Update to a fixed version once the JeecgBoot project confirms it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-108628 osv.dev
- Vulnerable code (SysDepartPermissionController) github.com
- Proof of concept (GitHub) github.com
- JeecgBoot 3.9.5 release notes newreleases.io
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:04.
Original description (NVD)
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.
NVD references (3)
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_dep…
- https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-…
- https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-savedeptrolepermission…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.