CVE-2026-111688 Exrick CVE debrief

Who should care

System administrators and security teams responsible for Exrick XBoot deployments should assess their authentication and authorization controls to prevent potential unauthorized access to department data.

Why it matters

CVE-2026-111688 is a medium-severity authorization bypass vulnerability in Exrick XBoot through 3.3.4. Authenticated users can manipulate the openDataFilter parameter to potentially retrieve the entire organization's department tree and names outside their assigned scope. System administrators and security teams should assess their authentication and authorization controls to prevent potential unauthorized access to department data.

• Potential unauthorized access to department data
• Bypass of role data-scope restrictions
• Increased risk of data exposure
• Need for verification of authentication and authorization controls

Technical summary

The vulnerability allows authenticated users to bypass role data-scope restrictions by sending openDataFilter=false in department getByParentId or search endpoints, potentially retrieving the entire organization's department tree and names outside their assigned scope. This is a medium-severity authorization bypass vulnerability in Exrick XBoot through 3.3.4, which requires verification of authentication and authorization controls to prevent potential unauthorized access to department data. The vulnerability can be exploited by manipulating the openDataFilter parameter, and system administrators and security teams should assess their authentication and authorization controls to prevent potential data exposure.

Defensive priority

Medium priority for authentication and authorization control assessments

Recommended defensive actions

• Assess authentication and authorization controls for Exrick XBoot deployments
• Verify role data-scope restrictions are properly implemented
• Monitor for potential unauthorized access to department data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Exrick XBoot through 3.3.4. The vulnerability allows authenticated users to bypass role data-scope restrictions by manipulating the openDataFilter parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.