JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department… (CVE-2026-108633)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) where low-privileged authenticated users can exploit the POST /sys/sysDepartPermission/add API to create department permission bindings. By submitting arbitrary departId, permissionId, and dataRuleIds fields, attackers can attach menu, button, and data rule grants to any department, effectively delegating permissions to roles without proper authorization checks.

The vulnerability allows unauthorized privilege escalation within the application by enabling low-privileged users to assign permissions to departments and their roles. This can lead to unauthorized access to functionality or data governed by those permissions. There is no indication of confidentiality or availability impact, only integrity impact due to unauthorized permission modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint and monitor for suspicious permission changes. Implement additional authorization checks if possible.