JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any… (CVE-2026-108888)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController exportXls handler. This vulnerability permits any authenticated user, regardless of privilege level, to invoke the /sys/sysDepartRole/exportXls endpoint and export all sys_depart_role records. The exported data includes sensitive role information such as names, codes, descriptions, and the identities of the users who created these roles. The vulnerability has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a network attack vector with low attack complexity and requiring low privileges, resulting in limited confidentiality impact without affecting integrity or availability.

An attacker with minimal authenticated privileges can access and export sensitive department role information, potentially aiding in further reconnaissance or privilege escalation attempts. The confidentiality of role-related data is compromised, but there is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /sys/sysDepartRole/exportXls endpoint to authorized users only, and review authentication and authorization controls around role export functionality.