EUVD-2026-96585
GHSA-xrqv-cwxg-4rp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitCraft malicious Excel workbook
-
ExecutionPOST to SysCategory importExcel endpoint
-
ImpactInject arbitrary nodes into sys_category dictionary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level (PR:L) with network reachability to the SysCategoryController importExcel handler; the attacker must submit a crafted Excel (.xlsx) workbook to that endpoint. No non-default configuration, no user interaction, and no administrative role are needed - the authorization check is simply absent on the import handler in default deployments through version 3.9.5. The primary limiting factor is the authentication requirement: unauthenticated outsiders cannot exploit it, so realistic risk centers on malicious or compromised low-privilege accounts rather than anonymous internet attackers. |
| Impact | This is a genuine but modest-severity issue best treated as low-to-medium priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-862 (Missing Authorization) are internally consistent: a low-privileged authenticated user can reach the importExcel handler over the network with no special conditions, and the impact is limited to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect. Publicly available POC code (VulnCheck advisory plus a GitHub exploit script) raises practical exploitability, but this is NOT the same as active exploitation - the CVE is not listed in CISA KEV, so the correct characterization is 'publicly available exploit code exists,' not in-the-wild exploitation. No EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data. The practical ceiling of harm is low: PR:L means an attacker already needs a valid account, and the only outcome is injecting arbitrary entries into the system-wide sys_category dictionary (data integrity), not code execution, data theft, or service disruption. Net: a real, POC-backed authorization-enforcement bug worth patching, but a high-CVSS-style emergency it is not - the 5.3 (medium) rating accurately reflects limited integrity-only impact behind authentication. |
| Exploit ScenarioDerived | A user with any low-privileged JeecgBoot account authenticates and sends a crafted Excel workbook to the SysCategoryController importExcel endpoint, which fails to enforce authorization. The attacker bulk-inserts arbitrary nodes into the shared sys_category dictionary - including under existing parent nodes - polluting system-wide reference data that other users and modules rely on. A working POC exploit script is publicly available on GitHub, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in the SysCategoryController importExcel handler of JeecgBoot through 3.9.5 allows any authenticated user - of any privilege level - to bulk-insert arbitrary nodes into the system-wide sys_category dictionary by uploading a crafted Excel workbook. Because the endpoint lacks a role or permission check, a low-privileged account can add entries, including under existing parent nodes, tampering with a shared configuration dictionary; the impact is limited to integrity (no confidentiality or availability loss per the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N assessment), and the primary limiter is that a valid login is required, so unauthenticated outsiders cannot exploit it. Publicly available exploit code exists and the issue is referenced by VulnCheck, but there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so deployments on JeecgBoot through 3.9.5 should apply compensating controls. First, enforce authorization at the application layer by adding an explicit permission/role annotation (e.g., the platform's @RequiresPermissions-style check for the category-import permission) or a servlet filter to the SysCategoryController importExcel mapping, so the handler requires an administrative privilege rather than merely a valid session - verify the change against your own build since no upstream fix commit was provided. Second, where the import feature is not business-critical, disable or reject requests to that endpoint at the reverse proxy/WAF (block the import path for non-admin roles); the trade-off is that legitimate bulk category imports by administrators will also be blocked unless allow-listed by role or source. Third, restrict network access to the administrative API surface (management UIs/endpoints) to trusted networks or VPN, noting this reduces exposure but does not fix the underlying missing check. Fourth, monitor and alert on sys_category insertions and on importExcel calls from low-privilege accounts, and review existing sys_category entries for unauthorized nodes, since exploitation manifests as unexpected dictionary entries. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-importexcel) and the referenced PoC for detection guidance; because exploitation requires only an authenticated account, prioritize credential hygiene and least-privilege account management as a containment measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source Java/Spring Boot low-code development platform whose system module exposes REST controllers for administrative data such as the sys_category dictionary (a system-wide set of categorized dictionary entries used by other features). CVE-2026-108646 is a CWE-862 Missing Authorization flaw: the importExcel handler in SysCategoryController (source lines ~265-339 in the referenced repository snapshot) performs authentication but does not enforce the permission/role check that other mutating endpoints rely on, so any account able to authenticate can invoke the import path. The handler parses an uploaded .xlsx workbook and persists each row as a sys_category node, which lets the caller insert arbitrary entries into the shared dictionary, including beneath existing parent nodes; the attacker controls the workbook contents, so both the node values and their placement are attacker-influenced. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*: denotes the product generically, and the description scopes the defect to versions through 3.9.5. Under the assessed vector, only integrity is impacted at a low level (VI:L) and no scope change or availability/confidentiality effect is expected, which is consistent with a data-integrity/authorization gap rather than remote code execution.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint and no special complexity (AV:N/AC:L); a low-privileged authenticated session is required (PR:L); impact is limited dictionary-data injection, so I:L with C:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, including under existing parent nodes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB