CVE-2026-111688 — Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. …
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7