JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries… (CVE-2026-108639)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the deletePhysic handler of the SysDictController. Authenticated users with low privileges can send DELETE requests to the /sys/dict/deletePhysic/{id} endpoint to permanently delete active data dictionaries and their associated items, bypassing any recycle bin or soft-delete mechanism. This vulnerability leads to irreversible data loss of dictionaries and their contents.

The vulnerability allows low-privileged authenticated users to cause permanent deletion of data dictionaries and their items, resulting in data integrity loss and potential disruption of application functionality relying on these dictionaries. There is no confidentiality impact, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the deletePhysic endpoint to only trusted users and monitor usage of this endpoint closely. Implement additional authorization checks if possible to prevent unauthorized deletion.