CVE-2026-111689

18th percentile - higher than 18% of all known CVEs

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

The vulnerability allows unauthorized access to employees' personal data from other departments, potentially leading to privacy breaches and use of data in social engineering attacks. The organization may face reputational and legal damage.

Update XBoot to a version later than 3.3.4 or apply the vendor patch. It is also recommended to verify and strengthen role data scope controls.