A missing authorization check in JeecgBoot’s SysRoleController allows authenticated users with lower privileges to modify role data rules via the POST /sys/role/datarule endpoint. By supplying permissionId, roleId, and dataRuleIds, an attacker can overwrite the data_rule_ids field, effectively removing row‑level filter restrictions for roles and expanding the data they can read or altering filtering for other roles. The vulnerability does not grant arbitrary code execution but permits unauthorized escalation within the application’s role‑based access control system.

The issue affects installations of JeecgBoot version 3.9.5 and earlier. Users running these or older releases are at risk of having their role data rules manipulated without proper authorization.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated and could exploit the flaw by sending crafted POST requests to the /sys/role/datarule endpoint—a likely attack vector inferred from the interface description.