EUVD-2026-96583
GHSA-c65v-wj9g-2r5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate node IDs via rootList/childList
-
ExploitInvoke unauthorized delete handler
-
ExecutionDelete sys_category subtrees
-
ImpactBreak dependent forms and dictionaries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the JeecgBoot instance (PR:L) - exploitation is not possible unauthenticated. The attacker needs network reachability to the application's SysCategoryController delete endpoint plus the rootList and childList endpoints, which the advisory describes as unguarded, so no special feature flag or non-default configuration is required beyond having any logged-in user. The practical limiting factor is account access: deployments where low-privilege or self-registered accounts are hard to obtain substantially reduce exposure, while multi-tenant or publicly-registrable instances are most at risk. Impact is limited to deletion of sys_category dictionary nodes and resulting breakage of dependent forms/fields - no confidentiality exposure or code execution. |
| Impact | This is a medium-severity, authorization-only flaw (CWE-862) whose real-world risk is moderate and bounded. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) is internally consistent with the description: network-reachable, low-complexity, and requiring only a low-privileged authenticated account - not unauthenticated. Impact is correctly scoped to partial integrity and availability (VI:L/VA:L) with no confidentiality loss (VC:N), matching a destructive-delete rather than data-theft or code-execution primitive. Publicly available exploit code exists (a Python PoC against the console delete routes), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of widespread or automated active exploitation. The signals are therefore aligned rather than conflicting: a real, easily-weaponized data-destruction bug for anyone with a valid low-priv login, but not a critical RCE and not confirmed exploited in the wild. Priority should be treated as moderate - patch in normal cycles, prioritized higher for multi-tenant or externally-registrable JeecgBoot deployments where low-privilege accounts are easy to obtain. Note: no EPSS value was provided in the input, so probabilistic exploitation likelihood could not be weighed. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user queries the unguarded rootList and childList endpoints to enumerate sys_category node IDs, then calls the SysCategoryController delete handler - which fails to check authorization - to remove those nodes. A public Python PoC (poc_console_delete_routes.py) automates this, letting the attacker delete entire category subtrees and break any forms or dictionary fields that depend on them. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authenticated users on JeecgBoot through 3.9.5 can delete arbitrary sys_category dictionary nodes through the SysCategoryController delete handler, which performs no permission check, allowing low-privileged accounts to remove entire category subtrees and break dependent forms and dictionary-backed fields. The node identifiers needed for the attack are freely exposed by the unguarded rootList and childList endpoints, so no special configuration or elevated role is required - only a valid login, meaning the practical barrier is simply obtaining any account (publicly available exploit code exists, per a linked GitHub PoC). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - a medium-severity, authorization-only flaw whose impact is bounded to integrity and availability of dictionary data, with no confidentiality exposure and no code execution; the reported CVSS 5.3 is consistent with that view.
RemediationAI
No vendor-released patch is identified in the available intelligence at time of analysis, so remediation must initially rely on compensating controls while a fixed release beyond 3.9.5 is awaited; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-delete) and the JeecgBoot project for a patched version, and upgrade immediately once published. Because exploitation requires only being authenticated, the highest-value control is shrinking the authenticated population: disable public self-registration and guest/low-privilege account provisioning on internet-facing instances, and audit existing accounts for unnecessary access - the trade-off is reduced self-service onboarding for legitimate users. In parallel, enforce authorization in front of the controller by adding gateway, reverse-proxy, or WAF rules that block DELETE requests to the SysCategory delete endpoint and restrict the rootList/childList endpoints to trusted administrative roles, accepting the operational risk of breaking legitimate dictionary administration if the rules are too broad. Where feasible, apply a temporary application-layer permission check (for example a @RequiresPermissions-style guard) on the delete handler and confirm that only administrative roles retain category-dictionary write access. Finally, enable and forward audit logging for category deletion events and take a database backup of the sys_category table so that deleted subtrees can be restored, since the flaw causes destructive integrity and availability impact rather than data disclosure; the publicly available PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.py can be used to validate that the chosen controls actually block the request pattern.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module exposes REST controllers under the jeecg-module-system artifact. CVE-2026-108644 is a CWE-862 (Missing Authorization) defect in SysCategoryController: the delete handler (referenced at lines 165-177 of the controller source) processes requests without validating that the caller holds the permission needed to mutate category dictionaries, while the companion rootList and childList read endpoints are similarly unguarded and disclose the node identifiers required to target a specific subtree. Because authorization is absent at the controller layer rather than merely misconfigured, the flaw is reachable by any principal that has authenticated to the application - the CVSS 4.0 vector records PR:L, AV:N, AC:L, UI:N with low integrity and availability impact (VI:L/VA:L) and no confidentiality, scope, or subsequent-system impact. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates the entire version lineage up to and including 3.9.5 is in scope; the vendor's advisory (VulnCheck) and the linked controller source are the primary technical references.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable delete handler needs only a low-privileged authenticated account (PR:L, AV:N, AC:L); no confidentiality loss, with partial integrity and availability impact from subtree deletion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB