---
id: CVE-2025-15124
title: A vulnerability was identified in JeecgBoot up to 3.9.0
summary: >-
  A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the
  function getParameterMap of the file /sys/sysDepartPermission/list. The
  manipulation of the argument departId leads to improper authorization. The
  attack can be in…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-266
  - CWE-285
  - CWE-863
vendor: jeecg
product: jeecg_boot
affected:
  - jeecg_boot <= 3.9.0
published: '2025-12-28'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15124'
references:
  - url: 'https://github.com/Hwwg/cve/issues/37'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.338502'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.338502'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.711776'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00314
epssPercentile: 0.22476
ingestedAt: '2026-10-13T09:20:23.165Z'
---

## Overview

A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `jeecg_boot <= 3.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.