JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department… (CVE-2026-108634)

CVE-2026-108634 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5. Low-privileged authenticated users can exploit this flaw by sending DELETE requests to the /sys/sysDepartPermission/deleteBatch endpoint with specific IDs obtained from an unguarded list endpoint. This allows them to delete department permission bindings, effectively removing menus and buttons that departments assign to roles. The vulnerability is classified under CWE-862 (Missing Authorization).

The vulnerability allows unauthorized modification of department permission bindings, which can lead to denial of service or disruption of role-based access controls. While it does not directly disclose sensitive information, it impacts integrity and availability by allowing low-privileged users to remove permissions that departments have assigned to roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to permission deletions. Avoid exposing the list endpoint that reveals row IDs to unauthorized users.