JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged… (CVE-2026-108870)

The vulnerability in JeecgBoot through version 3.9.5 exists in the SysRoleController saveDatarule handler due to missing authorization checks. Low-privileged authenticated users can exploit this by sending permissionId, roleId, and dataRuleIds parameters to overwrite data_rule_ids. This manipulation can clear or alter row-level filters, enabling unauthorized access to data beyond intended permissions.

Exploitation of this vulnerability can result in unauthorized modification of role-based data filtering rules, potentially allowing attackers to access or view data they should not have permission to see. The impact includes confidentiality and integrity loss of data filtered by roles. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SysRoleController saveDatarule handler to trusted users only and monitor for suspicious activity related to role data rule modifications.