A missing authorization check in JeecgBoot allows an authenticated user with low privileges to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. The vulnerability enables the attacker to retrieve row identifiers from an unguarded list endpoint and supply them to the deleteBatch operation, thereby removing menus and buttons that departments can grant to roles. This loss of access control can degrade the security posture of the application by altering role definitions and potentially exposing sensitive functionality to unauthorized users.

JeecgBoot versions up to and including 3.9.5 are affected. No specific sub‑product or version sub‑range is further delineated beyond the overall 3.9.5 release. The CVE references the core JeecgBoot module rather than a derivative product.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not reported, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate, then use the public list endpoint to obtain identifiers before invoking the deleteBatch endpoint. This sequence requires legitimate credentials but not elevated privileges, indicating that an attacker with any account can potentially abuse the flaw if the endpoint is reachable. Given the lack of a known exploit and the relatively moderate score, the immediate risk is moderate but should be addressed promptly to prevent privilege escalation or denial of service to legitimate department management processes.