Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-10976: JeecgBoot getDepartUserList improper authorization

CVE-2025-10976 · published 1 year ago

Summary

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jeecg	jeecg_boot	<= 3.8.2 `cpe:2.3:a:jeecg:jeecg_boot::::::::`

Original advisory text

JeecgBoot getDepartUserList improper authorization

A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10976... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-10976 Vendor Advisory
https://vuldb.com/?ctiid.325847 Third Party Advisory
https://www.cnblogs.com/aibot/p/19063349 Exploit
https://vuldb.com/?id.325847 Vendor Advisory
https://vuldb.com/?submit.653333 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-266Incorrect Privilege Assignment

CWE-285Improper Authorization

Timeline

Published25 Sep 2025

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2025-10976 · NVD

CVE-2025-10976 · OSV

Track software like this

Free during beta