CVE-2025-10979: Jeecg Boot Authorization Bypass Vulnerability

CVE-2025-10979 Overview

CVE-2025-10979 is an improper authorization vulnerability in JeecgBoot versions up to 3.8.2. The flaw resides in an unknown function of the /sys/role/exportXls endpoint. An authenticated remote attacker with low privileges can invoke this endpoint to export role data without the required authorization checks. The vendor JeecgBoot was contacted about this disclosure but did not respond. The weakness is tracked under CWE-266: Incorrect Privilege Assignment. Public disclosure has occurred, increasing the likelihood of opportunistic exploitation against exposed JeecgBoot instances.

Critical Impact
A low-privileged remote user can invoke /sys/role/exportXls to obtain role configuration data that should be restricted to administrators.

Affected Products

JeecgBoot versions up to and including 3.8.2
Deployments exposing the /sys/role/exportXls endpoint
Applications built on the affected jeecg:jeecg_boot component

Discovery Timeline

2025-09-25 - CVE-2025-10979 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-10979

Vulnerability Analysis

JeecgBoot is a low-code development platform widely used to build enterprise web applications. The /sys/role/exportXls endpoint generates an Excel export of system role definitions. This endpoint fails to enforce the authorization checks required for role management operations. Any authenticated session with low-level privileges can call the endpoint and receive the exported role data.

The issue is categorized as improper authorization under CWE-266. Role data typically includes permission mappings, role identifiers, and descriptive metadata used to enforce access control across the application. Disclosure of this data supports privilege escalation planning and lateral movement inside the application.

A public write-up describing the issue is referenced by VulDB Entry #325850 and a Cnblogs analysis. The attack requires network access to the JeecgBoot instance and a valid low-privileged account.

Root Cause

The export handler for role data does not verify that the caller holds the administrative privilege required to read the role catalog. Authentication alone is treated as sufficient, so any user session bypasses the intended role management authorization boundary.

Attack Vector

Exploitation is performed over the network with low privileges and no user interaction. An attacker authenticates with any valid account, then issues an HTTP request to the /sys/role/exportXls endpoint. The server returns an XLS file containing role definitions that should have been restricted to privileged administrators.

No verified proof-of-concept code is published in the referenced advisories. See the VulDB CTI entry for additional technical context.

Detection Methods for CVE-2025-10979

Indicators of Compromise

HTTP requests to /sys/role/exportXls originating from non-administrative user sessions.
Unexpected XLS downloads from the /sys/role/ path in web server or reverse proxy logs.
Repeated access to /sys/role/exportXls from a single account within short time windows, indicating enumeration.

Detection Strategies

Correlate authenticated session privilege level with access to /sys/role/exportXls and alert when non-admin roles trigger the endpoint.
Baseline normal usage of role export functionality; administrators typically call it rarely and from known workstations.
Deploy web application firewall rules that require an administrative role claim before permitting requests to /sys/role/* paths.

Monitoring Recommendations

Enable verbose access logging on the JeecgBoot application server for all /sys/role/ endpoints.
Forward authentication and application logs to a centralized analytics platform for correlation and long-term retention.
Monitor outbound data transfers from JeecgBoot hosts for XLS files that match role export patterns.

How to Mitigate CVE-2025-10979

Immediate Actions Required

Restrict network access to JeecgBoot administrative paths, including /sys/role/exportXls, using a reverse proxy or WAF allowlist.
Audit application accounts and remove unused or over-privileged users that could authenticate and reach the vulnerable endpoint.
Review recent access logs for calls to /sys/role/exportXls and rotate any role or credential material that may have been exposed.

Patch Information

No vendor patch or advisory has been published for CVE-2025-10979 at the time of writing. The vendor did not respond to disclosure attempts. Monitor the JeecgBoot project references on VulDB for updates and track new releases beyond version 3.8.2.

Workarounds

Place a reverse proxy in front of JeecgBoot that requires an administrative role claim before forwarding requests to /sys/role/exportXls.
Disable or block the /sys/role/exportXls route at the ingress layer if role export is not used operationally.
Enforce network segmentation so that JeecgBoot management interfaces are reachable only from trusted administrative networks.

bash

# Example NGINX block for the vulnerable endpoint
location = /sys/role/exportXls {
    allow 10.0.0.0/24;   # administrative subnet
    deny all;
    proxy_pass http://jeecgboot_upstream;
}