JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by… (CVE-2026-108874)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) where any authenticated user can call the PUT /sys/user/changeDepartChargePerson endpoint to assign or remove department heads. Attackers with low privileges can supply arbitrary userId, department id, and status parameters to promote any user to a department head or demote current department heads, thereby expanding or altering department-scoped access controls. The CVSS 3.1 score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthorized modification of department head assignments, which can lead to unauthorized access to department-scoped views or functions. While it does not impact confidentiality or availability, it affects the integrity of role assignments within the application, potentially enabling privilege escalation within departmental boundaries.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint where possible and monitor for unauthorized use of department head assignment functions.