JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules… (CVE-2026-108647)

The vulnerability in JeecgBoot up to version 3.9.5 involves a missing authorization check in the SysCheckRuleController's importExcel handler. Low-privileged authenticated users can exploit this flaw by uploading specially crafted Excel workbooks, which allows them to bypass the system:checkRule:add permission. Consequently, attackers can bulk-create encoding validation rules across the system using arbitrary regular expression patterns, potentially impacting system integrity.

The vulnerability allows unauthorized creation of validation rules by low-privileged users, which could lead to manipulation of system-wide encoding validation logic. The CVSS score of 4.3 (medium severity) reflects limited impact on confidentiality and availability but indicates an integrity impact due to unauthorized rule creation. There is no indication of confidentiality or availability compromise. No known exploits in the wild have been reported.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the importExcel functionality and monitor for suspicious activity related to validation rule creation.