JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary… (CVE-2026-108643)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) that permits low-privileged authenticated users to delete category dictionary entries via the DELETE /sys/category/deleteBatch endpoint. Attackers can leverage unguarded rootList and childList endpoints to gather node IDs and submit them to recursively delete entire sys_category subtrees. This deletion can break dependent forms and dictionary fields, impacting application functionality. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows low-privileged authenticated users to delete critical category dictionary entries and entire subtrees within the sys_category structure. This can cause disruption or breakage of dependent forms and dictionary fields within the application, potentially impacting data integrity and application functionality. There is no confidentiality impact, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and review authorization controls to prevent unauthorized deletion of category dictionary entries.