---
id: CVE-2025-15119
title: A vulnerability was detected in JeecgBoot up to 3.9.0
summary: >-
  A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the
  function queryPageList of the file /sys/sysDepartRole/list. The manipulation
  of the argument deptId results in improper authorization. The attack can be
  execut…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-266
  - CWE-285
  - CWE-863
vendor: jeecg
product: jeecg_boot
affected:
  - jeecg_boot <= 3.9.0
published: '2025-12-28'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15119'
references:
  - url: 'https://github.com/Hwwg/cve/issues/32'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.338497'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.338497'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.711771'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00276
epssPercentile: 0.18504
ingestedAt: '2026-10-13T09:20:23.163Z'
---

## Overview

A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `jeecg_boot <= 3.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.