CVE-2026-9580

HIGH

JeecgBoot selectDepart LoginController.selectDepart access control

Title source: cna
STIX 2.1

Description

A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/selectDepart. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is sufficient to fix this issue. It is suggested to upgrade the affected component.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365636 | JeecgBoot selectDepart LoginController.selectDepart access control
https://vuldb.com/vuln/365636
Signature, Permissions Required signature permissions-required
VDB-365636 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365636/cti
Third Party Advisory third-party-advisory
Submit #817892 | JeecgBoot 3.9.1 Improper Access Controls
https://vuldb.com/submit/817892

Scores

CVSS v3 7.3
EPSS 0.0029
EPSS Percentile 20.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-284
Status published
Products (3)
None/JeecgBoot 3.9.0
None/JeecgBoot 3.9.1
None/JeecgBoot 3.9.2
Published May 26, 2026
Tracked Since May 27, 2026