---
id: "CVE-2026-111689"
kind: "vulnerability"
aliases: ["CVE-2026-111689"]
title: "XBoot: authenticated users can read any department's user records"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "self-hosted", "spring-boot", "xboot"]
not_affected_if: ["auth-required", "single-department"]
published_at: "2026-10-16T18:17:52+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111689", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# XBoot: authenticated users can read any department's user records

XBoot through 3.3.4 ignores role data scope on the user lookup endpoint GET /xboot/user/getByDepartmentId/{departmentId}. A logged-in user can pass any department id and read usernames, real names, mobile numbers, emails and account status.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the XBoot version in the deployed project's pom.xml or release tag; `3.3.4` and earlier are in the affected range.
- Request `GET /xboot/user/getByDepartmentId/{id}` with a low-privilege account and a department id outside its scope; a user list returned means exposure.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111689

## From the sources

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_