Is CVE-2026-111688 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111688?

CVE-2026-111688 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-111688

Description

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.