JeecgBoot versions up through 3.9.5 contain a missing authorization flaw that allows any authenticated user to invoke a PUT call to /sys/user/changeDepartChargePerson. By supplying arbitrary userIds, department identifiers, and status flags, an attacker can appoint themselves or another low‑privileged user as the head of a department, or demote an existing department head. The critical weakness is an authorization bypass, classified as CWE‑862, enabling unauthorized escalation of privileges within the system.

The issue affects JeecgBoot products published by jeecgboot, specifically versions through 3.9.5. Users of any earlier release that includes the SysUserController endpoint are potentially impacted. No additional version details are supplied, so all installations that have not yet applied a patch beyond 3.9.5 should be evaluated.

The CVSS score of 5.3 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no current widespread exploitation. However, because an authenticated user can modify department head assignments without further checks, a low‑privileged attacker could expand access to department‑scoped data, potentially affecting confidentiality and availability of internal resources. The likely attack vector is an authenticated web request against the exposed PUT endpoint; successful exploitation requires only credentials valid for a regular user account.