CVE-2026-108631
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-p
CVSS
5.4
Medio
EPSS
0.3%
p19
KEV
—
Exploit Today
6
0-100
Publicado: 10 oct 2026 · Última mod.: 13 oct 2026 · CWE-862
0.3%EPSS · 30 días0.3%
2026-10-112026-10-25
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.
- github.comhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_delete.py
- github.comhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L118-L123
- www.vulncheck.comhttps://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartpermission-delete
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1128394.3 MED—
———Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.10hCVE-2026-1057657.5 ALT—
———HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.10hCVE-2026-1163885.3 MED—
———Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.10hCVE-2026-1155985.3 MED—
———Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.10hCVE-2026-1155975.4 MED—
———Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.10hCVE-2026-93328——
———Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.12h