CVE-2026-108634 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot installations, especially those with low-privileged user accounts, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108634 is a medium-severity vulnerability in JeecgBoot that allows low-privileged authenticated users to delete department permission bindings. Defenders should verify exposure, especially in systems with low-privileged user access, and prioritize remediation to prevent unauthorized changes to access control.

• Potential unauthorized removal of department permission bindings by low-privileged users.
• Possible disruption to role-based access control in affected systems.
• Need for verification of current version and exposure to this vulnerability.
• Potential for compensating controls to mitigate until official remediation is applied.

Technical summary

The vulnerability exists in the SysDepartPermissionController of JeecgBoot, specifically in the deleteBatch method. Low-privileged authenticated users can exploit this by sending a DELETE request to the /sys/sysDepartPermission/deleteBatch endpoint with the ids of department permission bindings they wish to delete. This could allow attackers to remove menus and buttons that departments can grant to their roles, potentially disrupting role-based access control in affected systems. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to sensitive areas.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to sensitive areas.

Recommended defensive actions

• Verify the version of JeecgBoot being used and assess if it is vulnerable.
• Restrict access to the DELETE /sys/sysDepartPermission/deleteBatch endpoint.
• Monitor for unauthorized changes to department permission bindings.
• Implement additional authorization checks for low-privileged users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected systems and versions requires further verification from official sources. Defenders should verify the version of JeecgBoot being used, assess if it is vulnerable, and prioritize remediation to prevent unauthorized changes to access control. The vulnerability details indicate that low-privileged authenticated users can delete department permission bindings, which could lead to potential unauthorized removal of department permission

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.