JeecgBoot versions up to 3.9.5 contain a missing authorization flaw in the SysDepartPermissionController queryById handler. The vulnerability permits any authenticated user to issue a GET request to /sys/sysDepartPermission/queryById with an arbitrary id and retrieve department permission details such as depart_id, permission_id and data_rule_ids. This allows the disclosure of sensitive configuration data. Based on the description, it is inferred that this information could be used to map internal permissions and potentially plan further attacks.

The affected product is JeecgBoot, specifically all releases through version 3.9.5. The vulnerability is present regardless of the deployment environment as long as the queryById endpoint is enabled and a valid user credential can be authenticated.

The base CVSS score of 5.3 indicates a moderate risk; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack requires the attacker to be authenticated to the system; once authenticated, any user can enumerate department permission records simply by guessing or enumerating ids. Because the flaw grants read‑only data that does not expose immediate system control, the overall potential impact is limited to information disclosure, but the ease of exploitation suggests that any authenticated user on the network could abuse it.