JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission… (CVE-2026-108640)

JeecgBoot up to version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController's queryById handler. The handler does not enforce Shiro permission checks, enabling authenticated users with low privileges to retrieve sensitive department role details by issuing a GET request to /sys/sysDepartRole/queryById with arbitrary ids. This results in unauthorized disclosure of department role names, codes, descriptions, and audit metadata. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Low-privileged authenticated attackers can read sensitive department role information that should be access-controlled. The impact is limited to confidentiality loss of role metadata without integrity or availability effects. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious access patterns. Implement proper authorization checks on the queryById handler to enforce Shiro permissions.