JeecgBoot versions through 3.9.5 contain a missing authorization flaw (CWE-862) in the GET /sys/sysDepart/getDepartmentHead endpoint. Any authenticated user can invoke this API and receive a list of all staff members in a department, including names, avatars, posts, mobile numbers, telephone numbers, and even contacts marked as hidden. The flaw allows an attacker to harvest personal information from employees without elevated privileges, posing a risk of privacy violations and potential phishing or social engineering attacks.

The vulnerability affects the JeecgBoot application up to and including version 3.9.5. The affected component is the SysDepartController in the jeecg-system module, and any installation that has not applied an update beyond 3.9.5 is susceptible. Vendor:CVE vendors list jeecgboot:JeecgBoot.

The CVSS base score of 5.3 reflects a medium severity, indicating that while the impact is moderate, the attack requires only authentication, which the application presumes a user has. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. An attacker who compromises or legitimately authenticates with any user account can retrieve sensitive personnel data, which may be used for further attacks. The lack of authorization enforcement creates a clear path for data exfiltration in targeted or mass enumeration scenarios.