A missing authorization flaw (CWE-862) in the SysDepartController allows any authenticated user to import an Excel file via the /sys/sysDepart/appImportExcel endpoint. Attackers can craft an Excel workbook containing department data and upload it, causing the application to create arbitrary entries in the sys_depart table and thereby alter the administrator‑maintained department hierarchy. This grants low‑privileged users the ability to modify critical system configuration and potentially establish persistence by inserting malicious department records.

The vulnerability affects the JeecgBoot platform versions up to and including 3.9.5. The impacted component is the SysDepartController within the system module that handles the /sys/sysDepart/appImportExcel route. Users running any deployed instance of JeecgBoot prior to 3.9.6 are exposed.

The CVSS score of 5.3 indicates a medium severity. EPSS data is not available, so no evidence of active exploitation at this time is known. Based on the description, it is inferred that the attack vector requires the attacker to be authenticated within the application, which is a local‑application attack. The missing authorization (CWE‑862) permits the attacker to create department records without proper privilege checks, which could lead to unintended configuration changes or persistence. The risk is moderate, but in environments with relaxed role management, the impact could be more significant.