The vulnerability exists in JeecgBoot versions up to 3.9.5 and allows any authenticated user to modify department permission records through the edit endpoint. By calling this endpoint, an attacker can overwrite the depart_id, permission_id, and data_rule_ids fields, thereby controlling which menus and data rules a department may delegate. The primary impact is unauthorized access to administrative configuration and potential abuse of system resources, leading to loss of confidentiality of administrative data and integrity of application settings.

JeecgBoot 3.9.5 and earlier. The affected component is the SysDepartPermissionController within the JeecgBoot system module. No specific service or subsystem is noted beyond the web controller handling permission edits.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in KEV, suggesting it is not known to be exploited in the wild. Attackers require authenticated access, but the list endpoint that provides necessary identifiers is unprotected, meaning low-privileged users can discover target IDs without additional privileges. The attack vector is via the application’s web interface, requiring only valid credentials to perform the edit operation. Because any authenticated user can exploit the missing authorization check, the risk is moderate but still significant for organizations that rely on this application for data access control.