JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated… (CVE-2026-108644)

The vulnerability in JeecgBoot (up to version 3.9.5) is due to missing authorization checks in the SysCategoryController's delete handler. Authenticated users can leverage unguarded rootList and childList endpoints to enumerate node IDs and delete category dictionary nodes without proper permission validation. This results in the ability to remove entire sys_category subtrees, which can break functionality relying on these categories.

An attacker with any authenticated access can delete critical category dictionary nodes, potentially causing denial of service or data integrity issues by breaking dependent forms and dictionary fields. The impact affects integrity and availability but does not compromise confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious deletion activities related to category nodes.