CVE-2025-10980: Jeecg Boot Authorization Bypass Vulnerability

CVE-2025-10980 Overview

CVE-2025-10980 is an improper authorization vulnerability in JeecgBoot versions up to 3.8.2. The flaw affects an unknown function in the /sys/position/exportXls endpoint. An authenticated remote attacker with low privileges can exploit the issue over the network. The exploit has been disclosed publicly. The vendor was contacted before disclosure but did not respond. The weakness is classified as [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Low-privileged authenticated users can invoke the export function without proper authorization checks, exposing position data intended for privileged roles.

Affected Products

JeecgBoot versions up to and including 3.8.2
Component: jeecg:jeecg_boot
Vulnerable endpoint: /sys/position/exportXls

Discovery Timeline

2025-09-26 - CVE-2025-10980 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10980

Vulnerability Analysis

JeecgBoot is a low-code development platform commonly used to build enterprise back-office systems. The /sys/position/exportXls route exports position (job role) records to an Excel file. The endpoint fails to enforce role-based authorization consistent with the underlying data. As a result, users who authenticate with limited privileges can call the export function and retrieve records they should not be able to access.

Because the attack requires only network access and low privileges, any authenticated tenant account or self-registered account in an exposed deployment can reach the endpoint. The disclosed impact is limited to confidentiality of position data; integrity and availability are not affected.

Root Cause

The root cause is missing or insufficient authorization checks on the export handler. The endpoint validates authentication but does not verify that the caller holds the role required to enumerate position records. This matches the [CWE-266] pattern, where privileges are granted more broadly than the design intends.

Attack Vector

An attacker authenticates to a reachable JeecgBoot instance using any valid low-privilege account. The attacker then issues an HTTP request to /sys/position/exportXls and receives an Excel export containing position data. No user interaction is required, and the request can be issued remotely. Public disclosure references are available on VulDB entry 325851 and a Cnblogs security blog post.

No verified proof-of-concept code is included in this article. See the linked references for technical detail.

Detection Methods for CVE-2025-10980

Indicators of Compromise

HTTP requests to /sys/position/exportXls originating from accounts that do not hold administrative or HR roles.
Unexpected Excel export responses in web server access logs tied to low-privilege sessions.
Bulk or repeated calls to /sys/position/exportXls from a single session or IP address.

Detection Strategies

Review application access logs for calls to /sys/position/exportXls and correlate the calling user's role against expected access lists.
Enable audit logging on JeecgBoot's sys_position module and alert on export operations by non-privileged principals.
Deploy a web application firewall rule that flags or blocks unauthenticated and low-privilege requests to /sys/position/* endpoints.

Monitoring Recommendations

Track baseline request volume for /sys/position/exportXls and alert on deviations.
Monitor for newly created or dormant low-privilege accounts issuing export requests.
Forward JeecgBoot application logs to a centralized SIEM and retain them for post-incident review.

How to Mitigate CVE-2025-10980

Immediate Actions Required

Restrict network exposure of the JeecgBoot management interface to trusted networks or VPN users.
Audit user roles and remove low-privilege accounts that no longer require access.
Block or rate-limit requests to /sys/position/exportXls at the reverse proxy until a patch is applied.
Monitor the JeecgBoot GitHub repository for a fixed release addressing this issue.

Patch Information

No vendor patch or advisory has been published at the time of NVD entry. The vendor did not respond to disclosure attempts. Administrators should track the JeecgBoot release notes and apply the first version that supersedes 3.8.2 with an authorization fix for the position export handler.

Workarounds

Add an authorization filter or Spring interceptor that enforces role checks on /sys/position/exportXls before the controller executes.
Disable the position export feature in the UI and back end for tenants that do not require it.
Require multi-factor authentication for all JeecgBoot accounts to reduce the value of credential compromise.

bash

# Example nginx rule to restrict the vulnerable endpoint to trusted IPs
location = /sys/position/exportXls {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://jeecgboot_backend;
}