The flaw resides in the saveDeptRolePermission endpoint of the SysDepartPermissionController in JeecgBoot versions through 3.9.5. It lacks any authorization checks, enabling any authenticated user to supply arbitrary roleId and permissionIds values. The result is that a low‑privileged attacker can grant or revoke menu or button permissions for any department role, effectively elevating privileges or disrupting access for other users. This is a classic example of a missing authorization weakness.

The affected product is JeecgBoot, specifically all releases up to and including version 3.9.5. The vulnerability is located in the SysDepartPermissionController component that handles department permission assignments.

The CVSS score of 8.6 classifies the vulnerability as high severity, indicating substantial impact if exploited. The EPSS score is not available, so the probability of current exploitation is undetermined. The flaw is not listed in the CISA KEV catalog. Attackers require only that they have authenticated to the system; no additional privileges or conditions are needed to exercise the missing authorization and manipulate role permissions.