JeecgBoot up to version 3.9.5 implements a delete operation in SysDepartPermissionController without verifying that the requesting user has authorization to remove department permission bindings. An authenticated user with only low‑level privileges can therefore delete any department permission that is exposed through the list endpoint. The effect of this action is the removal of menu or button permissions that a department may grant to its roles, potentially weakening the overall access control structure of the system. The weakness is a classic missing authorization flaw (CWE‑862).

The vulnerability exists in the JeecgBoot application from the vendor JeecgBoot. Any deployment of JeecgBoot through version 3.9.5 is affected. No specific build numbers are listed beyond the 3.9.5 release.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, making it difficult to quantify the probability of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the application and then request the unguarded list endpoint to learn permission identifiers. With that information they can issue DELETE requests to remove bindings, requiring no special privileges beyond a normal user account. The exploitation path relies on standard HTTP requests and does not require any remote code execution or privilege escalation beyond dropping permissions.