CVE-2026-108636

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6

Description An authorization flaw exists in the appImportExcel handler within the SysDepartController. This issue allows any authenticated user, including those with low privileges, to import departments by uploading a specially crafted Excel workbook to the POST '/sys/sysDepart/appImportExcel' endpoint. This action enables the creation of arbitrary sys depart records within the department tree typically maintained by administrators.

Recommendations Update JeecgBoot to version 3.9.6 or later. As a temporary mitigation, restrict access to the '/sys/sysDepart/appImportExcel' endpoint to authorized administrative users only.