CVE-2026-111689 Details

An authorization bypass vulnerability has been identified in Exrick XBoot versions through 3.3.4. This vulnerability allows authenticated users to access user records from any department, disregarding role-based data scope restrictions. The issue arises in the UserController, where the 'getByDepartmentId' endpoint lacks proper data-scope checks. As a result, operators can retrieve sensitive information such as usernames, real names, mobile numbers, emails, and account status for users in departments outside their assigned scope.

The vulnerability can be addressed by adding data-scope checks to the 'getByDepartmentId' endpoint, ensuring that only user records from departments within the caller's scope are accessible. This can be done by modifying the UserServiceImpl to include a check that verifies the requested department ID is within the user's allowed department IDs before returning any user data.