Missing Authorization in JeecgBoot Allows User Data Exposure
CVE-2026-108635

5.3MEDIUM

Key Information:

Vendor

Jeecgboot

Status
Jeecgboot
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-108635?

JeecgBoot versions up to 3.9.5 contain a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of the SysDepartController. This flaw allows any authenticated user to enumerate department IDs and subsequently list sensitive information such as staff names, avatars, posts, and contact details, including mobile and telephone numbers. Importantly, even contacts that are marked as hidden can be retrieved, posing a significant privacy risk and potential for exploitation by low-privileged attackers.

Affected Version(s)

JeecgBoot 0 <= 3.9.5

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe19...
technical-description
https://www.vulncheck.com/advisories/jeecgboot-through-3....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.