CVE-2025-15120CWE-266CWE-285CWE-863broken-access-control

CVE-2025-15120

Low · published December 28, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00326 · 24.5th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2025-12-28T10:15Z
Affected products (1)
ProductVersionsFixed in
jeecg/jeecg_boot≤ 3.9.0—
References (4)
https://github.com/Hwwg/cve/issues/33 · [email protected]https://vuldb.com/?ctiid.338498 · [email protected]https://vuldb.com/?id.338498 · [email protected]https://vuldb.com/?submit.711772 · [email protected]
EPSS history
Timeline
  • 28 DEC 04:02Z
    JeecgBoot getDeptRoleList improper authorization
    cvelistv5