EUVD-2026-96582
GHSA-g88r-vhx2-7vc3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate node ids via unguarded rootList/childList
-
ExecutionSubmit ids to DELETE /sys/category/deleteBatch
-
ImpactRecursively delete sys_category subtrees breaking dependent forms
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated JeecgBoot account (PR:L) - the DELETE /sys/category/deleteBatch endpoint performs the deletion without verifying the caller is authorized for it, and the companion rootList/childList endpoints are unguarded, letting any authenticated user harvest the node ids needed to target subtrees. No special non-default configuration is named in the description; the operation works against standard deployments once any account exists. Limiting factors: an account is required (not fully anonymous), impact is confined to integrity/availability of the sys_category dictionary data (no confidentiality exposure and no code execution), and damage is a destructive data-loss/denial-of-function condition on dependent forms and dictionary fields. |
| Impact | This is a moderate, not critical, issue and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L), and impact is limited to integrity and availability of category data (VI:L/VA:L) with no confidentiality loss (VC:N) and no scope change - consistent with the base score of 5.3. CWE-862 (missing authorization) matches the described behavior: an authenticated-but-unauthorized user can reach a privileged delete operation. A public POC exists (reported by VulnCheck, with a GitHub exploit script), so exploitation is practically feasible, but there is NO CISA KEV listing and no EPSS value provided, so there is no evidence of active, widespread exploitation. The realistic risk is a post-authentication destructive/denial-of-service action against application data, not remote code execution or data theft. Net: a legitimate priority for JeecgBoot operators who allow low-trust accounts, but materially de-rated by the PR:L authentication requirement and the absence of confidentiality impact or KEV confirmation. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has phished/registered any low-trust account) calls the unguarded rootList and childList endpoints to enumerate sys_category node ids, then issues DELETE /sys/category/deleteBatch with those ids to recursively wipe entire category subtrees, breaking forms and dictionary fields that depend on them. A public POC script (poc_console_delete_routes.py) demonstrating this chain is available on GitHub, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to destroy the platform's sys_category dictionary data by calling DELETE /sys/category/deleteBatch, an endpoint that performs the deletion without verifying the caller holds permission for that operation. The companion rootList and childList endpoints are equally unguarded, so the same user can enumerate node ids and submit them to recursively delete whole sys_category subtrees, breaking dependent forms and dictionary fields across the instance. Publicly available exploit code exists (a Python PoC that drives the console delete route), but the issue is a moderate data-loss/denial-of-function condition rather than a critical one: an account is required, impact is limited to integrity and availability of dictionary data, and there is no confidentiality exposure or code execution.
RemediationAI
No vendor-released patch has been identified at time of analysis, so treat upgrading past 3.9.5 as the goal only once a fixed release is published and, until then, apply compensating controls. The highest-value control is to block or restrict the abusive routes at the edge: deny unprivileged roles access to DELETE /sys/category/deleteBatch and to the rootList and childList enumeration endpoints via the API gateway, reverse proxy, or the application's own permission configuration, noting the trade-off that legitimate category administration will then require an elevated role or an allow-listed admin path. Because the attack needs only a valid low-privilege account, reduce the blast radius by auditing and removing unused accounts, tightening account provisioning, and enabling authentication/authorization logging on the /sys/category routes so destructive calls can be detected and attributed. Take and retain backups of the sys_category table (or the full database) with a tested restore procedure, since the primary damage is unrecoverable dictionary data loss that breaks dependent forms; backups do not prevent the deletion but bound its business impact. Monitor the vendor advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-deletebatch and the JeecgBoot repository for an official fix, and validate any interim patch against the deleteBatch, rootList, and childList handlers rather than assuming a front-end change is sufficient. Reviewing the PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.py can help confirm whether your deployment exposes the exact routes the exploit targets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source Java/Spring Boot low-code development platform whose system module exposes REST controllers for administrative data. The affected component is SysCategoryController, which backs the sys_category tree of dictionary entries used by forms and field definitions throughout the application. The root cause is CWE-862 (Missing Authorization): the deleteBatch handler does not check that the calling principal has been granted the category-deletion permission, so the authorization decision relies solely on the user being authenticated. The enumeration half of the flaw is the same class of error on the rootList and childList read endpoints, which return category node ids without privilege checks; those ids are the required input to deleteBatch, which then removes the target node and its descendants. The reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) and the equivalent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) both describe a network-reachable, low-privilege, no-user-interaction attack with limited integrity and availability impact and no confidentiality impact. The CPE record cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* applies the finding to all JeecgBoot releases through 3.9.5; no non-default configuration is named as a prerequisite, so a standard deployment with at least one non-privileged account is sufficient.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity but requires any authenticated low-privileged account (PR:L); unauthorized deletion damages data integrity and availability of dependent features, with no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB