JeecgBoot through version 3.9.5 has a missing authorization flaw that allows users with low privileges who are already authenticated to alter any department by calling the PUT /sys/user/doUpdateDepartInfo endpoint. An attacker can change a department’s name, re‑parent it within the hierarchy, and replace or remove its designated heads without any ownership or tenant checks. The result is a violation of data integrity and potential disruption of internal organizational structure.

All installations of JeecgBoot up to and including version 3.9.5 are affected. The vulnerability resides in the JeecgBoot application packaged under the vendor JeecgBoot.

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. No EPSS score is available, and the issue is not listed in CISA's KEV catalog. The probable attack vector is an authenticated low‑privilege user who can still access the endpoint; no special conditions such as network reachability or elevated privileges are required beyond existing legitimate access.