xboot vulnerabilities
CVEs whose affected-version data names the xboot package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111688Medium· 4.3PoCExrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByP…
▾ TwilightExrick · xbootEPSS 0.33%via NVD
CVE-2026-111689Medium· 4.3PoCXBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{depart…
▾ TwilightExrick · xbootEPSS 0.34%via CVEORG