CVE-2026-108631

MediumCVSS 5.4/10Last modified Oct 13, 2026

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1086324.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows an CVE-2026-1086334.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department p CVE-2026-1086345.4JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department p CVE-2026-1086354.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartCont CVE-2026-1086364.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any aut CVE-2026-1086374.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group m CVE-2026-1086384.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group member CVE-2026-1086395.4JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data diction CVE-2026-108644.3A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were CVE-2026-1086404.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro per CVE-2026-1086414.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-a CVE-2026-1086424.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to m