CVE-2026-108628 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot deployments, particularly those with low-privileged user accounts, should assess exposure and verify the integrity of role permissions. System administrators and security teams should review and adjust role permissions to prevent unauthorized changes.

Why it matters

CVE-2026-108628 is a high-severity vulnerability in JeecgBoot that allows unauthorized role permission modifications, potentially leading to privilege escalation or unauthorized changes. Defenders should prioritize verifying and restricting access to the affected endpoint, reviewing and adjusting role permissions, and monitoring for suspicious activity. Evidence is limited to CVE and NVD records, with specific details on affected versions, exploitation, and remediation requiring further verification from official sources.

• Privilege escalation for low-privileged attackers
• Unauthorized role permission modifications
• Potential revocation of other users' permissions
• Need for verification of role permissions and endpoint access

Technical summary

The vulnerability exists in the saveDeptRolePermission endpoint of SysDepartPermissionController in JeecgBoot through version 3.9.5. This endpoint lacks proper authorization, allowing any authenticated user to modify department role permissions by submitting roleId and permissionIds values. This could lead to low-privileged attackers escalating their privileges or revoking other users' permissions.

Defensive priority

Defenders should prioritize verifying and restricting access to the affected endpoint, reviewing and adjusting role permissions, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and restrict access to the saveDeptRolePermission endpoint
• Review and adjust role permissions to prevent unauthorized changes
• Monitor for suspicious activity related to role permission modifications
• Perform a thorough review of existing role permissions to identify potential unauthorized changes
• Implement additional logging and monitoring to detect suspicious activity
• Conduct a thorough asset inventory to identify all systems that may be affected
• Establish a process for tracking and addressing exceptions

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.6 and CWE-862 classification. However, specific details about affected versions, exploitation, and remediation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.