CVE-2026-111689

Published: Oct 16, 2026Modified: Oct 21, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/manage/UserController.java#L223-L233

Source: disclosure@vulncheck.com

https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/UserServiceImpl.java#L178-L181

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/xboot-through-3.3.4-authorization-bypass-via-getbydepartmentid-endpoint

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.