JeecgBoot versions up to 3.9.5 contain a missing authorization flaw in the SysDepartPermissionController's saveDatarule handler. Any authenticated user can send a POST request to /sys/sysDepartPermission/datarule with departId, permissionId, and dataRuleIds parameters to alter or delete data rules that govern department‑menu permissions. The weakness, identified as CWE‑862, allows low‑privileged attackers to change access constraints and potentially grant themselves or others broader data visibility or control, thereby impacting the confidentiality and integrity of the system’s data layer.

The vulnerability affects the JeecgBoot application, specifically all releases up through version 3.9.5. Administrators should verify whether their instances run this or earlier releases and plan an upgrade accordingly.

The CVSS score of 5.3 indicates a moderate risk. Because the flaw requires an authenticated session, the attack vector is a remotely accessible web request that an authenticated user can trigger without additional privileges. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the probability of exploitation is uncertain, though the presence of the flaw means any compromised or legitimate low‑privileged account could exploit it. Monitoring for unusual data‑rule changes and applying the fix are advised to mitigate potential privilege escalation.