JeecgBoot versions up to 3.9.5 contain a missing authorization flaw in the saveDatarule endpoint of SysDepartRoleController. Because the application does not check the user's permissions before processing the POST request, an authenticated user with limited privileges can craft specific permissionId, roleId and dataRuleIds values in the request body. The handler writes these values directly into the data_rule_ids field of the database, effectively allowing the attacker to expand or change row‑level data access for any department role.

Any installation of the JeecgBoot framework running a version earlier than 3.9.6, particularly the 3.9.5 build, is affected. The vulnerability is present in the SysDepartRoleController implementation that handles the POST endpoint `/sys/sysDepartRole/datarule`. No other product or vendor is listed as impacted.

The CVSS base score is 5.3, indicating moderate severity. No EPSS score is available, so the probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate, but they can be any low‑privileged user. Once authenticated, they can issue a crafted POST request to the vulnerable endpoint, causing unauthorized modification of department role data rules. This could lead to elevated data visibility or incorrect filtering for users in those roles, potentially exposing sensitive information.