CVE-2026-108871

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6

Description An authorization flaw exists in the saveDatarule handler of the SysDepartRoleController. This issue allows authenticated users with low privileges to modify department role data rules by sending crafted values for the permissionId, roleId, and dataRuleIds variables. Successful exploitation enables an attacker to overwrite data rule ids, which can result in unauthorized widening of row-level data access or the alteration of filtering mechanisms for other department roles.

Recommendations Update to a version newer than 3.9.5. Restrict access to the saveDatarule handler in SysDepartRoleController to authorized administrative users only.