CVE-2026-111688

EUVD-2026-102979
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.96%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
exrickxboot
𝑥
≤ 3.3.4
CNA
Common Weakness Enumeration
References
https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/DepartmentServiceImpl.java#L35-L60
https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure
https://www.vulncheck.com/advisories/exrick-xboot-through-3.3.4-data-scope-bypass-via-opendatafilter-parameter
https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure