CVE-2025-15121 JeecgBoot getDeptRoleByUserId information disclosure
An attacker can exploit the getDeptRoleByUserId function to disclose sensitive department role information via the departId argument.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15121?
CVE-2025-15121 is a medium-severity vulnerability in Jeecg Jeecg Boot, published on 28 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Such manipulation of the argument departId leads to information disclosure. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-15121?
It affects 1 product.
Products include Jeecg Jeecg Boot.
How do I fix CVE-2025-15121?
No fix has been published for CVE-2025-15121 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15121 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15121 exists.
Other vulnerabilities in Jeecg Jeecg Boot
Sources
Also known as GHSA-gv85-863m-74jv.