CVE-2025-15120

Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0

Description A flaw exists in JeecgBoot that relates to improper authorization. The issue is present in the getDeptRoleList function located in the /sys/sysDepartRole/getDeptRoleList file. Manipulation of the departId argument can lead to this authorization problem. The attack can be carried out remotely, but requires a high degree of complexity and is considered difficult to exploit. The exploit for this issue has been published.

Recommendations JeecgBoot versions prior to 3.9.0 should be updated.