Exrick XBoot versions through 3.3.4 allow an authenticated user to bypass role‑based data‑scope restrictions by setting the openDataFilter parameter to false. This flaw is an authorization bypass (CWE‑863) that lets a legitimate user retrieve the entire organizational department tree and names outside the data scope they are permitted to see, exposing sensitive internal structure and potentially user identities.

The vulnerability is present in the Exrick XBoot open‑source project up to version 3.3.4. No later releases are listed as fixed, so any deployment running 3.3.4 or earlier is affected.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but an attacker must first authenticate to exploit it. The attack vector is likely internal or through a compromised authenticated session, with the consequence of unauthorized read access to department information. Because the flaw does not provide remote code execution or denial of service, the overall risk remains moderate but non‑negligible for organizations that rely on strict data‑scope controls.