VULNERABILITY INTELLIGENCE
CVE-2026-108870
CVSS score5.3 MEDIUM
CISA KEVNot currently listed
Published2026-10-11
Last modified2026-10-11
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level filters to widen readable records or altering filtering for other roles.
Weakness classification
- CWE-862: Missing Authorization