EUVD-2026-96578
GHSA-w6x3-2fqq-474q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any low-privileged account
-
ExploitEnumerate target dictionary IDs
-
ExecutionSend DELETE to /sys/dict/deletePhysic/{id}
-
ImpactIrreversibly erase dictionaries and all items
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold a valid authenticated JeecgBoot account of any privilege level (PR:L); no admin role, user interaction, or non-default configuration is required because the deletePhysic handler in SysDictController simply omits an authorization check. The only prerequisites are network access to the application and knowledge or enumeration of a dictionary {id} to target the DELETE /sys/dict/deletePhysic/{id} endpoint. Limiting factors: exploitation is gated by needing credentials (so it is an insider or compromised-account threat, not unauthenticated), impact is confined to deletion of data dictionaries and their items (data integrity/availability) with no confidentiality exposure or code execution, and it affects JeecgBoot versions through 3.9.5. |
| Impact | This is a moderate-severity, authenticated data-destruction flaw rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability with low attack complexity and no user interaction, but PR:L confirms a valid account is required, which meaningfully constrains the attacker population. Impact is limited to integrity and availability of data-dictionary records (VC:N/VI:L/VA:L) - there is no confidentiality loss, no code execution, and no scope change - consistent with the 5.3 medium score. Publicly available exploit code exists (a Python POC on GitHub) and the issue was reported by VulnCheck, which raises practical exploitability, but it is NOT listed in CISA KEV, so there is no evidence of active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here and should be checked against the current EPSS feed. The signals are internally consistent (no CVSS-vs-description conflict): a low-privileged authenticated user can irreversibly delete dictionaries by design-gap, matching CWE-862 missing authorization. Net: a real but bounded insider/compromised-account risk, not a wormable or unauthenticated-RCE priority. |
| Exploit ScenarioDerived | A low-privileged user (or an attacker who has phished or otherwise obtained any valid JeecgBoot account) authenticates to the application and issues a DELETE request to /sys/dict/deletePhysic/{id}. Because the deletePhysic handler performs no authorization check, the targeted data dictionary and all of its items are permanently removed, bypassing the recycle bin and corrupting dropdown/reference data that dependent business modules rely on. A public Python POC (poc_dict_physic_delete.py) automates this request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authenticated users of JeecgBoot through 3.9.5 can permanently delete data dictionaries and all of their items by sending DELETE requests to /sys/dict/deletePhysic/{id}, because the deletePhysic handler in SysDictController omits an authorization check (CWE-862); the hard delete bypasses the recycle bin and is irreversible. Any valid low-privilege account suffices - no administrator role, user interaction, or non-default configuration is required, only network access to the application and knowledge or enumeration of a target dictionary {id}. Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the impact is confined to integrity and availability of dictionary data (no confidentiality exposure or code execution), making this a moderate-severity insider or compromised-account threat.
RemediationAI
The provided intelligence does not include a vendor-released fix version, so no patched JeecgBoot release can be confirmed at time of analysis; teams should monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-dict-deletephysic-id) and upstream JeecgBoot releases for a fix beyond 3.9.5. Until then, the most effective compensating control is to block the DELETE /sys/dict/deletePhysic/{id} route at the edge (reverse proxy, API gateway, or a Spring Security filter) and allow dictionary deletion only through the recycle-bin-aware logical-delete path; the trade-off is that legitimate administrator 'physical delete' maintenance stops working, and path-matching rules must normalize URL encoding or attackers can bypass naive pattern matches. Alternatively, patch a maintained fork by adding the standard @RequiresPermissions/@PermissionData check - or removing the deletePhysic mapping entirely - in SysDictController.java around lines 742-751; this is effective but creates a custom build that must be re-applied on every upgrade. Reduce blast radius by limiting and auditing low-privilege accounts, alerting on DELETE requests to /sys/dict/deletePhysic/* and on dictionary-ID enumeration, and taking regular database backups of sys_dict and sys_dict_item so hard-deleted dictionaries can be restored; note backups mitigate rather than prevent the destructive action. Because publicly available exploit code exists (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_dict_physic_delete.py), defenders should prioritize detection of anomalous or bulk dictionary deletions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a textbook CWE-862 Missing Authorization in JeecgBoot's SysDictController, the Spring MVC controller that manages the platform's system data dictionaries (the sys_dict and sys_dict_item tables). JeecgBoot is a Java/Spring Boot low-code development platform distributed as a multi-module Maven project; the vulnerable code resides in jeecg-system-biz at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDictController.java, lines 742-751, mapped to DELETE /sys/dict/deletePhysic/{id}. Unlike hardened handlers elsewhere in the codebase that carry JeecgBoot's @RequiresPermissions/@PermissionData annotations or explicit role checks, this handler performs a 'physical' (hard) delete without any permission gate, so the framework's authentication filter alone - satisfied by any logged-in account - is enough to reach the destructive SQL. Because the operation is a physical delete rather than the logical/recycle-bin delete used by other dictionary endpoints, it cascades removal of the dictionary and its items with no recovery path. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* uses a wildcard version confirming all releases through 3.9.5 are in scope, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) aligns with the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable, low-privilege, no user interaction, with only integrity and availability impact and no confidentiality loss.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network endpoint reachable with low complexity and no UI; any authenticated account suffices so PR:L; deletion harms dictionary data integrity and availability (I:L/A:L) with no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB