Jeecgboot Through 3.9.5 Missing Authorization Via Savedeptrolepermission Endpoint

Back www.vulncheck.com

Jeecgboot Through 3.9.5 Missing Authorization Via Savedeptrolepermission Endpoint

www.vulncheck.com • October 11, 2026

Share: View original

JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

CWE-862 Missing Authorization

Researcher Proof of Concept

Vulnerable Code (v3.9.5)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JeecgBoot 3.9.5 Vulnerabilities: Missing Authorization Issues Two vulnerabilities have been identified in JeecgBoot versions up to 3.9.5, specifically in the saveDeptRolePermission and sysTenantPassapply endpoints. These vulnerabilities involve missing authorization checks, allowing unauthorized users to access sensitive functionalities. The issues are categorized under CWE-862, indicating a lack of proper authorization controls. Affected organizations using JeecgBoot should prioritize remediation to prevent potential exploitation. Currently, there is no indication of in the wild, but the existence of proof-of-concept code raises concerns. Security teams are advised to assess their systems and apply necessary updates if available. The vulnerabilities were disclosed on October 11, 2026, coinciding with the publication of advisories. 55

Extracted Entities

CWE Weaknesses (1)

CWE-862 - Missing Authorization

Vulnerabilities (1)

Missing Authorization