CVE-2026-111689
XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.
| CWE | CWE-639 |
| Vendor | exrick |
| Product | xboot |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for exrick xboot
Be the first to know when new medium vulnerabilities affecting exrick xboot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Exrick / xboot
0 ≤ 3.3.4
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure github.com: https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/UserServiceImpl.java#L178-L181 github.com: https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/manage/UserController.java#L223-L233 vulncheck.com: https://www.vulncheck.com/advisories/xboot-through-3.3.4-authorization-bypass-via-getbydepartmentid-endpoint
Credits
hieuPenguinnn