CVE-2026-108631 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot installations, especially those with low-privileged user access, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108631 is a medium-severity vulnerability in JeecgBoot that allows low-privileged authenticated users to delete department permission bindings. Defenders should verify and remediate this vulnerability, especially in sensitive systems.

• Potential unauthorized deletion of department permission bindings by low-privileged users.
• Possible disruption of role-based access control in departments.
• Need for verification of affected versions and scope.
• Prioritization of remediation efforts based on system sensitivity.

Technical summary

The vulnerability exists in the SysDepartPermissionController delete handler of JeecgBoot through 3.9.5. Low-privileged authenticated users can exploit this to delete department permission bindings by obtaining row ids from the unguarded list endpoint and sending DELETE requests with the id parameter. This allows them to remove menus or buttons departments can grant their roles. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to sensitive areas.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to sensitive areas.

Recommended defensive actions

• Verify the version of JeecgBoot being used and assess if it is vulnerable.
• Restrict access to the SysDepartPermissionController delete handler.
• Monitor for unusual DELETE requests to the SysDepartPermissionController.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the exact scope of affected systems and versions requires further verification from official sources. Defenders should verify the version of JeecgBoot being used, assess if it is vulnerable, and prioritize remediation efforts based on system sensitivity. The vulnerability allows low-privileged authenticated users to delete department permission bindings by obtaining row ids from the unguarded list endpoint and sending DELETE requests with the id parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.