TI-2026-75474 Aliases CVE-2026-111688 GHSA-cx4q-4p6j-g42p

Data-scope bypass in Exrick XBoot exposes department data

MEDIUM 57CWE-863Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Exrick XBoot through 3.3.4 contains an incorrect authorization flaw (CWE-863). An authenticated user with low privileges can send openDataFilter=false to the department getByParentId or search endpoint to evade role data-scope restrictions. The user can then retrieve the department tree and names of the whole organization, including departments outside their assigned scope.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00331 26th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Exrick	xboot	up to 3.3.4	—	No fix listed	CNA

xboot VendorExrick Affected up to 3.3.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:exrick:xboot::::::::	—	—	Exrick

cpe:2.3:a:exrick:xboot:*:*:*:*:*:*:*:* Versions — — ·Exrick

Remediation

The sources list no fixed version for xboot.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-111688
2026-10-16 Alias added: GHSA-cx4q-4p6j-g42p
2026-10-18 CISA SSVC decision points changed
2026-10-18 Priority changed: LOW → MEDIUM

References

Advisory 1

https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure

Other 1

https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/DepartmentServiceImpl.java#L35-L60

TI-2025-20784 An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges… CVSS 3.1CRITICAL 9.8
TI-2024-16005 xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18212 Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to… CVSS 3.1HIGH 8.2
TI-2025-07805 Exrick xboot Spring Boot Admin/Spring Actuator information disclosure CVSS 4.0MEDIUM 6.9
TI-2025-07808 Exrick xboot getMenuList sensitive information in a cookie CVSS 4.0MEDIUM 6.3
TI-2025-40386 Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper… CVSS 3.1MEDIUM 6.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences