CVE-2026-108636: JeecgBoot Authorization Bypass Vulnerability

CVE-2026-108636 Overview

CVE-2026-108636 is a missing authorization vulnerability [CWE-862] in JeecgBoot through version 3.9.5. The flaw resides in the SysDepartController.appImportExcel handler, which does not verify administrative privileges before processing department imports. Any authenticated low-privileged user can send a crafted Excel workbook to POST /sys/sysDepart/appImportExcel and insert arbitrary records into the sys_depart table. This allows attackers to pollute the administrator-maintained department tree, which can disrupt organizational hierarchies and downstream access decisions that depend on department membership.

Critical Impact

Authenticated users of any role can create arbitrary departments in the administrator-managed tree, enabling tampering with organizational structure used by downstream authorization logic.

Affected Products

• JeecgBoot versions up to and including 3.9.5
• jeecg-module-system component containing SysDepartController
• Deployments exposing the /sys/sysDepart/appImportExcel endpoint

Discovery Timeline

• 2026-10-10 - CVE-2026-108636 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108636

Vulnerability Analysis

The vulnerability stems from a missing authorization check in the appImportExcel handler of SysDepartController. The handler accepts an uploaded Excel workbook and parses rows into SysDepart entities, which are then persisted into the department tree. Standard department management endpoints in JeecgBoot are gated to administrators, but this specific import handler does not enforce the same role requirement. As a result, the authorization model for the department tree is inconsistent between creation paths.

An attacker with a valid session can submit the request and inject arbitrary parent-child department entries. Because department identifiers are referenced by role scoping, data permissions, and user assignment features, polluted records can influence subsequent authorization and data filtering decisions. The impact is limited to integrity of the department structure; confidentiality and availability are not directly affected.

Root Cause

The root cause is an omitted role or permission check on the import handler, classified as [CWE-862] Missing Authorization. The controller method is reachable by any authenticated principal because it is not annotated with the privilege guard applied to sibling administrative endpoints.

Attack Vector

Exploitation requires network access to the application and valid credentials for any low-privileged account. The attacker crafts an Excel file matching the expected column schema for sys_depart records and sends a multipart POST to /sys/sysDepart/appImportExcel. The server processes the upload and inserts the rows without validating that the caller is an administrator. A public proof-of-concept script demonstrating the request is available in the GitHub PoC Script, and the vulnerable handler source is documented in the GitHub SysDepartController Code.

Detection Methods for CVE-2026-108636

Indicators of Compromise

• Unexpected POST requests to /sys/sysDepart/appImportExcel originating from non-administrator user sessions.
• New rows in the sys_depart table whose create_by field references a non-administrator account.
• Unexplained changes in the department tree visible in the JeecgBoot administration console.

Detection Strategies

• Review web server and reverse proxy access logs for requests to /sys/sysDepart/appImportExcel and correlate the authenticated user role with the request.
• Enable application-level audit logging on department CRUD operations and alert when the caller does not hold an administrator role.
• Compare database snapshots of sys_depart over time to identify unauthorized insertions.

Monitoring Recommendations

• Instrument the Spring controller layer to log the authenticated principal and granted authorities for every call to department import handlers.
• Forward JeecgBoot application logs and database audit trails to a centralized analytics platform for anomaly correlation.
• Alert on multipart uploads to administrative endpoints from user agents or client IPs that have not previously performed administrative actions.

How to Mitigate CVE-2026-108636

Immediate Actions Required

• Restrict network access to the /sys/sysDepart/appImportExcel endpoint at the reverse proxy or Web Application Firewall layer to administrator source ranges.
• Audit the sys_depart table for records created by non-administrator users since deployment and remove unauthorized entries.
• Rotate any sessions or tokens held by users suspected of exploiting the handler.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for JeecgBoot. Refer to the VulnCheck Advisory on JeecgBoot and the upstream project for the most current remediation status. Apply the vendor patch as soon as it becomes available and verify that the appImportExcel handler enforces the same administrator role check as other department management endpoints.

Workarounds

• Add a server-side authorization annotation such as @RequiresRoles("admin") or an equivalent Spring Security check to the appImportExcel method and rebuild the jeecg-system-biz module.
• Block or filter the /sys/sysDepart/appImportExcel route at the gateway and allow it only for authenticated administrators.
• Disable the mobile department import feature if it is not required by the deployment.

# Example reverse proxy rule to restrict the vulnerable endpoint to admin IPs
location = /sys/sysDepart/appImportExcel {
    allow 10.0.0.0/24;   # administrator subnet
    deny all;
    proxy_pass http://jeecgboot_backend;
}