JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows… (CVE-2026-108631)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysDepartPermissionController's delete handler. Low-privileged authenticated users can exploit this by obtaining row IDs from an unprotected list endpoint and issuing DELETE requests with these IDs to remove department permission bindings such as menus or buttons assigned to roles. This results in unauthorized modification of permission bindings.

The vulnerability allows unauthorized modification of department permission bindings, potentially disrupting role-based access controls. While it does not directly expose confidential data, it can impact integrity and availability by allowing attackers to remove permissions improperly. The CVSS score of 5.4 reflects a medium severity with network attack vector, low attack complexity, and low privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, restrict access to the SysDepartPermissionController delete handler to only fully authorized users and monitor for unusual deletion requests. Avoid exposing unguarded list endpoints that reveal row IDs.