Live › vulnerability › CVE-2026-111688
Go to dashboardExrick XBoot through 3.3.4 lets an authenticated user add openDataFilter=false to the department getByParentId or search endpoints. That skips the role data-scope restriction, so the user sees the whole organization's department tree and names outside their scope.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Exrick XBoot 3.3.4 and earlier that use role-based data scopes and let ordinary logged-in users reach the department endpoints. Installations with a single tenant or no data-scope rules have little to lose, and anonymous access is not described as possible.
No product ranges from the sources yet.
openDataFilter=false and see whether results exceed the caller's data scope3.3.4: unknown whether the sources name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-111688")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.