The vulnerability is an improper access control flaw in the LoginController.selectDepart function of JeecgBoot, which allows an attacker to manipulate the /sys/selectDepart endpoint and bypass authentication checks, thereby gaining unauthorized access to sensitive data or operations. The weakness is rooted in insecure permission handling (CWE-266) and improper access control (CWE-284), enabling attackers to read or potentially modify data that should be restricted, compromising confidentiality and integrity.

JeecgBoot JeecgBoot software up to version 3.9.1 is affected. All installations running these versions or earlier are vulnerable. Upgrading to version 3.9.2, which contains the fix for the LoginController selectDepart access control issue, removes the vulnerability.

The CVSS score of 6.9 indicates moderate severity, and the exploit has been publicly disclosed, allowing remote attackers to perform the attack without additional privileges. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely remote, involving crafted HTTP requests to the /sys/selectDepart endpoint, and requires no local credentials. The risk is moderate due to the public disclosure and potential for unauthorized data access.