JeecgBoot CVE-2026-108880

Exploitation requires a valid authenticated JeecgBoot session (PR:L) - any registered/low-privilege user suffices, since the endpoint performs no ownership or role check on the supplied dictionary. The attacker must know or enumerate a target dictionary's low_app_id, which is directly obtainable from the GET /sys/dict/list endpoint available to authenticated users, then pass it via the lowAppId parameter or X-Low-App-ID header to PUT /sys/dict/editDictByLowAppId. Limiting factors: the instance must be reachable, the attacker must already hold credentials (no unauthenticated path), and impact is confined to modifying low-code application dictionaries (integrity only) - there is no direct data disclosure or service disruption. No non-default configuration or specific platform is required.

This is a genuine but moderate-severity access-control issue, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree on the core picture: network-reachable, low complexity, no user interaction, but requiring an already-authenticated low-privilege account (PR:L). Impact is limited to integrity (VI:L) with no confidentiality or availability loss (VC:N/VA:N), consistent with a horizontal authorization flaw that lets a user tamper with low-code dictionaries they should not control. Exploitation signals are mixed: publicly available exploit code exists (confirmed via the GitHub PoC reference), which raises practical exploitability, but the vulnerability is NOT on the CISA KEV list and no EPSS score was provided, so there is no evidence of active, widespread exploitation. Reporting by VulnCheck plus a working PoC make weaponization trivial for any attacker who already holds a valid JeecgBoot account, yet the PR:L requirement and integrity-only impact keep real-world risk in the medium band rather than critical. No conflicting signals were found between the CVSS vector and the description - both point to authenticated, remote, integrity-limited abuse.

An attacker who has obtained any valid JeecgBoot user account (e.g., a low-privilege employee, a self-registered user, or via a compromised credential) calls GET /sys/dict/list to harvest a target dictionary's low_app_id, then issues a crafted PUT to /sys/dict/editDictByLowAppId to rename that dictionary and overwrite its items. A public Python PoC (poc_edit_dict_by_low_app_id.py) already automates this, so no custom tooling is needed. Because the attack is network-based with low complexity and no user interaction, it can be performed in a single scripted request chain against any reachable instance.