Live › vulnerability › CVE-2026-111689
Go to dashboardXBoot through 3.3.4 ignores role data scope on the user lookup endpoint GET /xboot/user/getByDepartmentId/{departmentId}. A logged-in user can pass any department id and read usernames, real names, mobile numbers, emails and account status.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Exrick XBoot through 3.3.4 where more than one department exists and some accounts have a restricted data scope. Single-department installs or deployments where every user has the same scope lose little from this flaw. Teams on a later release or with the endpoint blocked at the gateway can skip it.
No product ranges from the sources yet.
3.3.4 and earlier are in the affected range.GET /xboot/user/getByDepartmentId/{id} with a low-privilege account and a department id outside its scope; a user list returned means exposure.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.
This page as .md · .json · in your agent: get_signal("CVE-2026-111689")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.