Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10976JeecgBoot getDepartUserList improper authorization

Low 3.1

In plain English

A low-severity security flaw in JeecgBoot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	JeecgBoot	3.8.03.8.13.8.2

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-325847 | JeecgBoot getDepartUserList improper authorization vdb-entry, technical-description
VDB-325847 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #653333 | jeecgboot 3.8.2 broken function level authorization third-party-advisory
https://www.cnblogs.com/aibot/p/19063349 exploit