The vulnerability is a missing authorization check in JeecgBoot that allows a low‑privileged authenticated user to POST to /sys/sysDepartPermission/add and create arbitrary department permission bindings. By supplying an arbitrary departId, permissionId, and dataRuleIds, the attacker can grant menu, button, and data rule privileges to any department, effectively delegating elevated permissions to roles under that department.

JeecgBoot 3.9.5 and earlier versions of the open‑source JeecgBoot framework are affected. Deployments that expose the /sys/sysDepartPermission/add API to authenticated users lack the necessary authorization guard.

The CVSS base score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Attackers only need authorized credentials with minimal privileges to exploit the missing check, making privilege escalation straightforward in an internal environment. The simplicity of the request and absence of additional constraints mean the attack can be carried out with little effort once credentials are available.