CVE-2026-108639 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's data dictionary management module. Specifically, this is an Insecure Direct Object Reference (IDOR) combined with a Broken Access Control flaw that affects the SysDictController component. The core issue resides in the deletePhysic handler, which processes HTTP DELETE requests targeting specific resource identifiers via the endpoint /sys/dict/deletePhysic/{id}. Unlike standard deletion operations that typically move data to a recycle bin for potential recovery or require elevated administrative privileges, this particular function performs an irreversible physical removal of records from the database. The absence of proper authorization checks means that any user who has successfully authenticated to the application can invoke this endpoint regardless of their assigned role or permission level within the system hierarchy.
From a technical perspective, the flaw stems from the controller's failure to validate whether the requesting user possesses the necessary privileges to perform destructive actions on data dictionaries. In secure implementations, such operations are typically restricted to users with specific administrative roles, such as System Administrator or Data Manager, and often include additional safeguards like multi-factor confirmation for permanent deletions. Here, the application relies solely on the presence of a valid session token rather than verifying role-based access control policies before executing the database deletion command. This allows low-privileged attackers who have obtained legitimate credentials to bypass intended security boundaries. The attacker can craft simple HTTP DELETE requests with arbitrary dictionary identifiers to target specific data structures or iterate through known IDs to perform mass destruction, effectively turning a routine administrative function into a weapon for data sabotage.
The operational impact of this vulnerability is severe due to the irreversible nature of the deletion process. Data dictionaries in enterprise applications like JeecgBoot serve as foundational configuration tables that define lookup values, dropdown options, and other static reference data used across various modules including user management, workflow engines, and reporting tools. The permanent removal of these entries without a recycle bin mechanism means there is no native application-level recovery path for the affected records. This can lead to widespread functional disruptions where forms fail to load due to missing option values, reports generate errors because referenced codes are absent, or system workflows break when critical configuration parameters disappear. Furthermore, since the deletion bypasses audit trails associated with standard soft-delete operations, forensic analysis of who removed which data becomes significantly more difficult unless external database logging is strictly enforced and monitored.
This vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-639 Authorization Bypass Through User-Controlled Key from the Common Weakness Enumeration taxonomy. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires initial authentication, followed by T1485 Data Destruction, where the attacker's goal is to impair or destroy data and information assets within an organizational system. The lack of role-based enforcement also reflects CWE-285 Improper Authorization, highlighting a fundamental gap in the application's security architecture regarding privilege escalation prevention for destructive actions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediately, organizations should apply the vendor-provided patch if available or upgrade to a version of JeecgBoot where this authorization check has been corrected. For environments unable to update immediately, network-level controls such as Web Application Firewalls can be configured to block DELETE requests to the /sys/dict/ path unless they originate from known administrative IP ranges, although this is less effective against authenticated insider threats. More robustly, developers must implement strict role-based access control checks within the SysDictController's deletePhysic method, ensuring that only users with explicit admin privileges can execute permanent deletions. Additionally, implementing a soft-delete mechanism by default for all critical configuration data provides a safety net against accidental or malicious loss. Enabling comprehensive audit logging for all destructive database operations and integrating these logs into a Security Information and Event Management system will enhance visibility and allow for rapid detection of such unauthorized activities.