JeecgBoot CVE-2026-108647

Requires a valid authenticated JeecgBoot account with low privileges (PR:L) - the flaw is reachable by any logged-in user, not anonymous visitors. The exact trigger is the SysCheckRuleController importExcel handler, which omits the system:checkRule:add permission check that normally gates validation-rule creation; the attacker must submit a crafted Excel (.xlsx) workbook to that import endpoint. Limiting factors: exploitation is gated on obtaining or possessing any authenticated session, so exposure is higher where JeecgBoot is internet-facing or where self-registration/weak account provisioning exists, and impact is confined to integrity of system-wide encoding validation rules (no direct data disclosure or service outage). Affects JeecgBoot versions through 3.9.5.

This is a medium-severity, lower-tier priority issue rather than an urgent emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires low-privileged authentication (PR:L), and the impact is limited to integrity only (VI:L) with no confidentiality or availability effect (VC:N/VA:N) - consistent with the 5.3 score and the CWE-862 missing-authorization root cause. The signals are mostly aligned: a public POC exists (increasing practical reachability for anyone with a valid account), but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation. The tension here is between POC availability (raises likelihood for authenticated insiders/attackers who have obtained any account) and the modest technical impact plus authentication requirement (caps real-world severity). The 'Authentication Bypass' tag is somewhat imprecise - the flaw is a missing authorization check (permission bypass for an already-authenticated user), not authentication bypass - which matters for accurate triage. Net: treat as a patch-in-normal-cycle item, not a drop-everything issue, unless JeecgBoot is internet-exposed with weak account controls.

A low-privileged but authenticated JeecgBoot user (e.g., a basic operator account) sends a crafted Excel workbook to the SysCheckRuleController importExcel endpoint, which fails to enforce the system:checkRule:add permission. The upload bulk-creates system-wide encoding validation rules containing arbitrary regular-expression patterns, letting the attacker tamper with validation logic across the platform. A public proof-of-concept (poc_c084_checkrule_import_xlsx.py) demonstrates the request, lowering the barrier to reproduction.