JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by… (CVE-2026-108873)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) whereby low-privileged authenticated users can invoke the PUT /sys/user/doUpdateDepartInfo API to modify any department. The flaw allows attackers to supply arbitrary department IDs to rename or change the parent department and to replace or remove department heads without verifying ownership or tenant permissions. This results in unauthorized integrity modification of organizational data.

The vulnerability enables unauthorized modification of department data by low-privileged authenticated users. It does not affect confidentiality or availability but allows integrity compromise of department names, hierarchy, and leadership assignments. This could lead to organizational confusion or misuse of department-related privileges.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious modification attempts.