# CVE-2026-108870: JeecgBoot authorization bypass in SysRoleController

Source: https://junglewise.ai/threats/cve-2026-108870-jeecgboot-through-3-9-5-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108870 · Severity: medium · CVSS 5.4 · Published 2026-10-11

JeecgBoot is a low-code development platform used to build enterprise applications. A flaw in its role management system allows authenticated users with low-level privileges to bypass authorization checks and modify data access rules, potentially exposing sensitive records across the organization or restricting legitimate access to data.

Technologies: [JeecgBoot](https://junglewise.ai/threats/technologies/jeecgboot). Vendors: [JeecgBoot](https://junglewise.ai/threats/vendors/jeecgboot).

## Quick answers

**Is CVE-2026-108870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108870 being exploited in the wild.

**How severe is CVE-2026-108870?** Medium severity, with a CVSS score of 5.4, published 11 October 2026.

**Which products and versions are affected?** JeecgBoot through 3.9.5.

**Is there a fix for CVE-2026-108870?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108870 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108870?** Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SysRoleController saveDatarule handler lacks proper authorization validation, allowing authenticated attackers to send crafted permissionId, roleId, and dataRuleIds parameters to overwrite data_rule_ids for any role. This clears row-level security filters, bypassing data access controls. The vulnerability requires valid authentication but no elevated privileges to exploit.

## Affected products

- JeecgBoot JeecgBoot through 3.9.5

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_role_datarule_write.py](https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_role_datarule_write.py)
- [https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysRoleController.java](https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysRoleController.java)

## Related threats

- [JeecgBoot SQL injection in Table Dictionary API](https://junglewise.ai/threats/cve-2026-124555-a-weakness-has-been-identified-in-jeecgboot-3-9-5-this)
- [JeecgBoot SQL injection in JimuBI drag chart endpoint](https://junglewise.ai/threats/cve-2026-124554-a-security-flaw-has-been-discovered-in-jeecgboot-3-9-5-this)
- [JeecgBoot SQL injection in SqlInjectionUtil keyword bypass](https://junglewise.ai/threats/cve-2026-112017-jeecgboot-before-3-9-5-contains-an-sql-injection-vulnerability)
- [JeecgBoot missing authorization in getUserDetailByUserId](https://junglewise.ai/threats/cve-2026-108891-jeecgboot-through-3-9-5-contains-a-missing-authorization)
- [JeecgBoot authorization bypass in SysDepartRoleController exportXls](https://junglewise.ai/threats/cve-2026-108888-jeecgboot-through-3-9-5-contains-a-missing-authorization)