JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any… (CVE-2026-108632)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the SysDepartPermissionController queryById handler. Authenticated users can exploit this flaw by issuing GET requests to /sys/sysDepartPermission/queryById with arbitrary department permission record IDs, thereby reading sensitive permission-related data such as depart_id, permission_id, and data_rule_ids without proper authorization checks.

The vulnerability allows unauthorized disclosure of department permission records to any authenticated user, including those with low privileges. This could lead to information leakage about internal permission configurations, potentially aiding further attacks or privilege escalation attempts. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious access patterns. Avoid exposing department permission data to low-privileged users.