{"id":"CVE-2026-111688","kind":"vulnerability","aliases":["CVE-2026-111688"],"related":[],"title":"XBoot: a parameter flag lets logged-in users read the whole department tree","description":"Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.","summary":"Exrick XBoot through 3.3.4 lets an authenticated user add openDataFilter=false to the department getByParentId or search endpoints. That skips the role data-scope restriction, so the user sees the whole organization's department tree and names outside their scope.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","self-hosted","spring-boot","xboot"],"not_affected_if":["auth-required","single-scope-deployment"],"how_to_check":"- Check the XBoot version in the deployed project's pom.xml or release tag: unknown whether the sources name the exact fixed version\n- Send an authenticated request to the department getByParentId or search endpoint with `openDataFilter=false` and see whether results exceed the caller's data scope","fix":"- Move XBoot past `3.3.4`: unknown whether the sources name the fixed release\n- Until patched, restrict access to the department endpoints at the gateway or reverse proxy","status":"open","published_at":"2026-10-16T18:17:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:04+00:00","updated_at":"2026-10-25T04:27:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move XBoot past `3.3.4`: unknown whether the sources name the fixed release\n- Until patched, restrict access to the department endpoints at the gateway or reverse proxy","reach":"network","title":"XBoot: a parameter flag lets logged-in users read the whole department tree","impact":"low","summary":"Exrick XBoot through 3.3.4 lets an authenticated user add openDataFilter=false to the department getByParentId or search endpoints. That skips the role data-scope restriction, so the user sees the whole organization's department tree and names outside their scope.","category":"package","nicknames":[],"who_cares":["xboot","java","spring-boot","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Logged-in users read the organization's full department tree and names","analyst_note":"Confirm the fixed XBoot version and whether the same flag affects other data-scope endpoints; the NVD entry is the only source.","how_to_check":"- Check the XBoot version in the deployed project's pom.xml or release tag: unknown whether the sources name the exact fixed version\n- Send an authenticated request to the department getByParentId or search endpoint with `openDataFilter=false` and see whether results exceed the caller's data scope","needs_analyst":true,"not_affected_if":["auth-required","single-scope-deployment"],"who_is_affected":"Deployments of Exrick XBoot 3.3.4 and earlier that use role-based data scopes and let ordinary logged-in users reach the department endpoints. Installations with a single tenant or no data-scope rules have little to lose, and anonymous access is not described as possible.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3333,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111688':17A,20A '-2026':16A,19A '3.3.4':33B,74C 'add':38B 'allow':81C 'append':97C 'assign':119C 'attack':95C 'authent':36B,82C 'author':77C 'boot':28B 'bypass':78C 'contain':75C 'cve':15A,18A 'data':53B,88C 'data-scop':52B,87C 'depart':13A,43B,64B,102C,113C 'endpoint':47B,106C 'entir':110C 'evad':85C 'exrick':30B,71C 'fals':40B,94C 'flag':4A 'getbyparentid':44B,103C 'host':25B 'java':21B 'let':5A,34B 'log':7A 'logged-in':6A 'name':67B,116C 'opendatafilt':39B,93C 'organ':62B,111C 'outsid':68B,117C 'packag':22B 'paramet':3A,99C 'read':10A 'restrict':55B,90C 'retriev':108C 'role':51B,86C 'scope':54B,70B,89C,120C 'search':46B,105C 'see':59B 'self':24B 'self-host':23B 'send':92C 'skip':49B 'spring':27B 'spring-boot':26B 'tree':14A,65B,114C 'user':9A,37B,58B,83C 'vulner':79C 'whole':12A,61B 'xboot':1A,29B,31B,72C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Exrick XBoot 3.3.4 and earlier that use role-based data scopes and let ordinary logged-in users reach the department endpoints. Installations with a single tenant or no data-scope rules have little to lose, and anonymous access is not described as possible.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111688","severity":null,"published_at":"2026-10-16T18:17:52+00:00","modified_at":"2026-10-16T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}