JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to create department permission bindings. This occurs via the POST /sys/sysDepartPermission/add endpoint, allowing attackers to assign arbitrary permissions to any department, potentially delegating unauthorized access to roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController queryById handler. This flaw allows any authenticated user, including low-privileged attackers, to retrieve department permission records by sending GET requests with arbitrary IDs. The exposed data includes depart_id, permission_id, and data_rule_ids for any department. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings. This occurs via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row IDs from an unprotected list endpoint and use them to remove menus and buttons that departments grant to their roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController delete handler. This flaw allows low-privileged authenticated users to delete department permission bindings by exploiting an unprotected DELETE endpoint. Attackers can retrieve row IDs from an unguarded list endpoint and use them to remove menus or buttons that departments grant to roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartPermissionController. This flaw allows any authenticated user, including those with low privileges, to modify department permission records by accessing the edit endpoint. Attackers can retrieve row IDs from an unprotected list endpoint and overwrite department and permission identifiers, potentially altering delegated menus and data rules.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartController appImportExcel handler. This flaw allows any authenticated user, including low-privileged attackers, to import departments by uploading a crafted Excel file. Exploiting this vulnerability enables unauthorized creation of arbitrary sys_depart records within the administrator-maintained department tree. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysMessageController queryById handler. This flaw allows low-privileged authenticated users to access message push records belonging to other users by supplying arbitrary record IDs to the GET /sys/message/sysMessage/queryById endpoint. The vulnerability exposes message content and receiver addresses without proper access control.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the SysMessageController deleteBatch handler. This flaw allows low-privileged authenticated users to delete message records by exploiting an unprotected list endpoint to obtain record IDs and submitting them to the deleteBatch function. The vulnerability can lead to unauthorized deletion of message push records, including those queued for delivery.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records. By calling the PUT /sys/message/sysMessage/edit endpoint, attackers can overwrite fields such as title, content, receiver address, and send status of any sys_sms record without ownership verification.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the loadDatarule handler of SysRoleController. This flaw allows any authenticated user, including low-privileged attackers, to query role data rules by sending a GET request to /sys/role/datarule/{permissionId}/{roleId}. The exposed information includes rule names, columns, conditions, values, and bound rule IDs for any role. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to modify message templates. Attackers can retrieve template IDs from an unprotected list endpoint and use the PUT /sys/message/sysMessageTemplate/edit API to overwrite system notification titles and content with attacker-controlled text or links. This vulnerability does not impact confidentiality or availability but allows integrity modification of message templates.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysLogController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete system audit log entries. By sending a DELETE request with the parameter ids set to 'allclear', an attacker can erase the entire sys_log table, removing all users' audit trails.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysPositionController edit handler. This flaw allows any authenticated user, including low-privileged attackers, to modify organizational position details such as names, codes, and ranks. Attackers can obtain position IDs from an unprotected list endpoint and then send PUT or POST requests to the /sys/position/edit endpoint to make unauthorized changes.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to create message templates by sending a POST request to /sys/message/sysMessageTemplate/add. This allows attackers with minimal roles to insert arbitrary notification templates into the shared sys_sms_template library used for system, email, SMS, and IM notifications. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiragExtDataController's delete handler. This flaw allows low-privileged authenticated users to delete AI evaluator or test-tracking records belonging to other users by sending DELETE requests with arbitrary id parameters. The vulnerability does not require user interaction and has a medium severity rating.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragExtDataController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete AI evaluator and test-tracking records belonging to other users by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint. The vulnerability arises because this endpoint lacks owner or tenant checks.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysPositionController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete organizational positions by sending comma-separated position IDs. These IDs can be obtained from an unprotected list endpoint, enabling attackers to remove all sys_position records and orphan user-position assignments. The vulnerability has a medium severity with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete audit log entries. Attackers can obtain log IDs from the unprotected /sys/log/list endpoint and remove specific sys_log records to erase evidence of their activities.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to delete message templates via a specific API endpoint. This deletion can disrupt template-based notifications such as workflow reminders. The vulnerability has a medium severity with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AigcWordTemplateController's delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete word templates by sending DELETE requests with an id parameter. The vulnerability results in unauthorized deletion of shared library templates.