JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint. This flaw allows any authenticated user, including low-privileged attackers, to enumerate department IDs and retrieve sensitive staff information such as names, avatars, posts, and contact numbers, even if marked hidden. The vulnerability does not allow modification or denial of service but exposes confidential data.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the saveDatarule handler of the SysDepartPermissionController. This flaw allows any authenticated user, including low-privileged attackers, to modify department data rules by sending crafted POST requests. The vulnerability enables unauthorized changes, additions, or removals of data rules on department-menu permission bindings.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the saveDeptRolePermission endpoint of the SysDepartPermissionController. This flaw allows any authenticated user, including low-privileged attackers, to modify department role permissions by submitting crafted roleId and permissionIds values. Exploitation can lead to privilege escalation or unauthorized revocation of other users' permissions.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to create department permission bindings. This occurs via the POST /sys/sysDepartPermission/add endpoint, allowing attackers to assign arbitrary permissions to any department, potentially delegating unauthorized access to roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController queryById handler. This flaw allows any authenticated user, including low-privileged attackers, to retrieve department permission records by sending GET requests with arbitrary IDs. The exposed data includes depart_id, permission_id, and data_rule_ids for any department. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings. This occurs via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row IDs from an unprotected list endpoint and use them to remove menus and buttons that departments grant to their roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController delete handler. This flaw allows low-privileged authenticated users to delete department permission bindings by exploiting an unprotected DELETE endpoint. Attackers can retrieve row IDs from an unguarded list endpoint and use them to remove menus or buttons that departments grant to roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController. This flaw allows any authenticated user, including those with low privileges, to modify department permission records by accessing the edit endpoint. Attackers can retrieve row IDs from an unprotected list endpoint and overwrite department and permission identifiers, potentially altering delegated menus and data rules.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartController appImportExcel handler. This flaw allows any authenticated user, including low-privileged attackers, to import departments by uploading a crafted Excel file. Exploiting this vulnerability enables unauthorized creation of arbitrary sys_depart records within the administrator-maintained department tree. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysMessageController queryById handler. This flaw allows low-privileged authenticated users to access message push records belonging to other users by supplying arbitrary record IDs to the GET /sys/message/sysMessage/queryById endpoint. The vulnerability exposes message content and receiver addresses without proper access control.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the SysMessageController deleteBatch handler. This flaw allows low-privileged authenticated users to delete message records by exploiting an unprotected list endpoint to obtain record IDs and submitting them to the deleteBatch function. The vulnerability can lead to unauthorized deletion of message push records, including those queued for delivery.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records. By calling the PUT /sys/message/sysMessage/edit endpoint, attackers can overwrite fields such as title, content, receiver address, and send status of any sys_sms record without ownership verification.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the loadDatarule handler of SysRoleController. This flaw allows any authenticated user, including low-privileged attackers, to query role data rules by sending a GET request to /sys/role/datarule/{permissionId}/{roleId}. The exposed information includes rule names, columns, conditions, values, and bound rule IDs for any role. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragAppController release handler. This flaw allows any authenticated user, including low-privileged attackers, to publish or unpublish AI applications belonging to other users. Attackers can send POST requests to the /airag/app/release endpoint to obtain share tokens, which expose applications to anonymous chat access, or to invalidate existing share links. The vulnerability has a medium severity rating with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to modify message templates. Attackers can retrieve template IDs from an unprotected list endpoint and use the PUT /sys/message/sysMessageTemplate/edit API to overwrite system notification titles and content with attacker-controlled text or links. This vulnerability does not impact confidentiality or availability but allows integrity modification of message templates.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysLogController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete system audit log entries. By sending a DELETE request with the parameter ids set to 'allclear', an attacker can erase the entire sys_log table, removing all users' audit trails.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysPositionController edit handler. This flaw allows any authenticated user, including low-privileged attackers, to modify organizational position details such as names, codes, and ranks. Attackers can obtain position IDs from an unprotected list endpoint and then send PUT or POST requests to the /sys/position/edit endpoint to make unauthorized changes.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to create message templates by sending a POST request to /sys/message/sysMessageTemplate/add. This allows attackers with minimal roles to insert arbitrary notification templates into the shared sys_sms_template library used for system, email, SMS, and IM notifications. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiragExtDataController's delete handler. This flaw allows low-privileged authenticated users to delete AI evaluator or test-tracking records belonging to other users by sending DELETE requests with arbitrary id parameters. The vulnerability does not require user interaction and has a medium severity rating.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragExtDataController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete AI evaluator and test-tracking records belonging to other users by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint. The vulnerability arises because this endpoint lacks owner or tenant checks.