JeecgBoot up to version 3.9.5 contains a missing authorization flaw in the SysUserController’s batchEditUsers endpoint (CWE-862) that allows any authenticated user to modify the department assignments of arbitrary users. The flaw permits attackers to send PUT requests containing user and department identifiers to move users, including administrators, between departments and overwrite job positions. This unauthorized manipulation could be leveraged for privilege escalation or to obscure malicious activity.

The vulnerability affects all installations of JeecgBoot employing the open‑source JeecgBoot application up to and including version 3.9.5. No newer versions are listed as affected.

The CVSS base score of 5.3 indicates a moderate severity; the vulnerability requires authentication but imposes no additional external access requirements. Because EPSS data is unavailable and the bug is not listed in CISA’s KEV catalog, the likelihood of external exploitation is likely limited to compromised credentials or internal actors. Nevertheless, the potential to move administrators between departments represents a significant risk for internal privilege abuse or data integrity compromise.