JeecgBoot CVE-2026-108645

Requires a valid authenticated session as any application user, even low-privileged (CVSS PR:L), on a JeecgBoot instance at or below version 3.9.5. The attacker must know or enumerate a target sys_category node id to supply in the POST or PUT body to /sys/category/edit. No user interaction (UI:N) and no special non-default configuration are required - the SysCategoryController edit handler lacks an authorization check by default. The principal limiting factor is the authentication requirement: unauthenticated external attackers cannot exploit this directly. Impact is confined to integrity of shared classification data; there is no direct confidentiality or availability effect.

This is a genuine but moderate-severity issue, not a high-impact priority. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (medium), and the impact profile is narrow: integrity-only (VI:L), with no confidentiality (VC:N) or availability (VA:N) impact. Crucially, PR:L means exploitation requires an existing authenticated account, which substantially lowers real-world risk versus an unauthenticated flaw. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC), raising practical exploitability, but this is NOT the same as active exploitation - the CVE is not listed in CISA KEV and no EPSS score is provided in the input, so widespread opportunistic exploitation cannot be inferred. The signals are internally consistent: a low-complexity, network-reachable, authenticated authorization gap (CWE-862) with a working PoC but limited blast radius. The dominant mitigating factor is the authentication requirement combined with integrity-only impact; the dominant aggravating factor is that the altered sys_category nodes are system-wide, so a single low-privileged user can affect classification values used across many forms. No SSVC decision data was provided in the input.

A low-privileged but authenticated user of a JeecgBoot deployment sends a crafted POST or PUT request to /sys/category/edit supplying the id of a system-wide sys_category node. Because SysCategoryController does not enforce authorization on the edit operation, the request succeeds and renames, recodes, or relocates the shared classification node, corrupting dictionary values relied upon across multiple forms. A public Python PoC (poc_c082_category_edit.py) demonstrates the request, and the network vector with low attack complexity makes the request trivial to reproduce once a valid session exists.