JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets… (CVE-2026-108871)

The vulnerability in JeecgBoot (up to version 3.9.5) is due to missing authorization checks in the saveDatarule handler within the SysDepartRoleController. This allows authenticated users with low privileges to manipulate department role data rules by submitting crafted permissionId, roleId, and dataRuleIds parameters. As a result, attackers can overwrite data_rule_ids, which may expand row-level data access or change filtering criteria for other department roles, potentially leading to unauthorized data exposure or modification.

An attacker with low-level authenticated access can modify department role data rules, potentially increasing their data access privileges or altering data filtering for other roles. This can lead to unauthorized information disclosure or integrity issues at the row-level data access control. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to role data rule modifications.