Exrick XBoot versions up to 3.3.4 contain a flaw that allows any authenticated user to bypass role‑based data scoping when accessing the getByDepartmentId endpoint. The vulnerability lets an attacker specify an arbitrary department ID and retrieve detailed user records—including usernames, real names, mobile phone numbers, email addresses, and account status—normally restricted by department. This leakage exposes personally identifiable information and operational data, potentially aiding credential harvesting or social engineering. The weakness is classified as CWE‑639, an authorization bypass due to insufficient data filtering.

The issue affects all installations of Exrick XBoot version 3.3.4 or earlier. The product is used in web applications that expose user data APIs. The vulnerability manifests in the getByDepartmentId endpoint located in the UserController and UserServiceImpl components. No specific platform or operating system dependencies are mentioned, so any environment running this XBoot version is exposed.

The CVSS score of 5.3 indicates a medium severity, reflecting that while the vulnerability does not provide remote code execution, it permits unauthorized data disclosure. No EPSS score is available, so baseline exploitation likelihood is unclear, but the absence of hard access controls suggests malicious actors could abuse it readily if authentication credentials are available. The vulnerability is not listed in CISA's KEV catalog, indicating no known mass exploitation yet. The likely attack vector is internal or compromised user accounts, as the flaw requires authentication. Once an attacker obtains a valid session, they can exploit the endpoint by supplying any department ID to enumerate user information.