CVE-2026-111688: Incorrect Authorization in Exrick xboot

CVE-2026-111688 describes an authorization bypass vulnerability in Exrick XBoot through version 3.3.4. Authenticated users can evade role data-scope restrictions by appending the parameter openDataFilter=false to the department getByParentId or search API endpoints. This bypass allows retrieval of the full organizational department hierarchy and names outside the user's authorized scope, potentially exposing sensitive organizational structure information.

The vulnerability allows authenticated users to access department data beyond their assigned scope, potentially leading to unauthorized disclosure of organizational structure and department names. There is no indication of privilege escalation beyond data exposure or of remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected endpoints to trusted users and monitor for suspicious use of the openDataFilter parameter. Avoid granting unnecessary authenticated access to the affected API endpoints.