HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108628 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa...

·Source: NIST NVD

Updated:

Executive Summary

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.

Analysis

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions. CVSS Score: 8.1. Published: 2026-10-10T22:16:37.590.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108628
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Splunk, SolarWinds Release Fresh Security Updates

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure

Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities

Infosecurity Magazine
CRITICALVulnerability

Cisco Patches 34 Vulnerabilities Across Multiple Products

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek .

SecurityWeek