CVE-2026-108643 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's category management module. Specifically, this is an insecure direct object reference combined with missing function-level authorization that allows authenticated users with low privileges to perform destructive actions intended for administrators. The core technical flaw resides in the DELETE /sys/category/deleteBatch endpoint, which processes deletion requests without verifying whether the requesting user possesses the necessary administrative rights or ownership of the target resources. This design oversight enables any logged-in user, regardless of their assigned role or permission level, to execute batch deletions on system category dictionaries.
The operational impact is severe due to the recursive nature of the deletion process and the lack of input validation regarding node hierarchy integrity. Attackers can exploit this by first querying unguarded endpoints such as rootList and childList to enumerate the structure of the sys_category table. These endpoints do not enforce sufficient access controls, allowing adversaries to map out the entire tree of category nodes. Armed with this structural knowledge, an attacker can submit a DELETE request containing specific node identifiers that trigger recursive deletion logic. This action does not merely remove isolated entries but cascades through dependent relationships, effectively dismantling entire subtrees within the system's configuration data.
The consequences of such unauthorized deletions extend beyond simple data loss. Since JeecgBoot relies heavily on these category dictionaries to define field types and form structures for its low-code development platform, destroying them can break dependent forms and dictionary fields across multiple applications built on the framework. This leads to widespread functional instability where user interfaces may fail to render correctly or submit data improperly because their underlying schema definitions have been obliterated. The integrity of the application's metadata layer is compromised, potentially requiring extensive manual reconstruction from backups if automated recovery mechanisms are not in place.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration or Privilege Separation when considering the broader context of session management, though it is primarily an authorization bypass. In terms of offensive security tactics, this behavior maps to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires initial authentication, followed by T1564 Hidden Files and Directories if used for persistence or evasion, but more accurately reflects data destruction capabilities akin to T1485 Data Destruction. The ability to enumerate resources via unguarded APIs also touches upon information disclosure principles found in CWE-200 Exposure of Sensitive Information to an Unauthorized Actor.
Mitigation strategies must address both the immediate code flaw and broader architectural weaknesses. Developers should implement strict role-based access control checks on all administrative endpoints, ensuring that only users with specific high-level privileges can invoke deletion functions. Input validation must be strengthened to verify not just user permissions but also the legitimacy of node IDs against expected hierarchical structures before processing recursive deletions. Additionally, sensitive enumeration endpoints like rootList and childList should have their own access controls applied or rate limiting implemented to prevent easy mapping by malicious actors. Regular security audits focusing on authorization logic in CRUD operations are essential to identify similar gaps across other modules within the JeecgBoot ecosystem.