JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify… (CVE-2026-108630)

CVE-2026-108630 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5 within the SysDepartPermissionController. Authenticated users can exploit this flaw by calling the edit endpoint to modify department permission records without proper authorization checks. Low-privileged attackers can enumerate row IDs from an unguarded list endpoint and overwrite fields such as depart_id, permission_id, and data_rule_ids, thereby changing which menus and data rules departments may delegate.

The vulnerability allows low-privileged authenticated users to alter department permission configurations, potentially leading to unauthorized changes in menu access and data rule delegations. This could result in improper permission assignments within the affected system. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SysDepartPermissionController endpoints to trusted users only and monitor for unauthorized modification attempts.