CVE-2026-108644 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified as Broken Access Control under the CWE-269 standard. This flaw resides within the SysCategoryController component, which is responsible for managing category dictionary nodes that serve as foundational data structures for various application functionalities. The core technical deficiency lies in the delete handler method of this controller, which fails to verify whether the authenticated user possesses the necessary administrative privileges or ownership rights before executing a deletion operation. Consequently, any user who has successfully authenticated to the system can invoke this endpoint without restriction, bypassing intended security boundaries that should restrict such destructive actions to authorized administrators only.
The operational impact of this vulnerability is severe due to the cascading effects on dependent application components. Attackers with low-privileged accounts can exploit unguarded endpoints, specifically rootList and childList, which expose node identifiers without adequate access restrictions. By harvesting these node IDs from the public or semi-public API responses, an attacker can target specific entries in the sys_category table. The deletion of entire subtrees within this category structure disrupts the integrity of dependent forms and dictionary fields that rely on these nodes for configuration and data validation. This leads to functional breakage across multiple modules, potentially causing application instability, loss of critical metadata, or complete unavailability of features tied to the deleted categories.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized actions. It also reflects aspects of T1496, Resource Hijacking or Data Manipulation, depending on whether the intent is purely destructive or aimed at disrupting service availability for other users. The lack of server-side authorization checks allows a low-privilege user to escalate their effective impact significantly, turning a simple authenticated session into a vector for significant system disruption. This scenario highlights the danger of relying solely on client-side restrictions or assuming that all API endpoints are implicitly protected by general authentication layers without specific role-based access control enforcement at each action level.
To mitigate this vulnerability, immediate remediation should focus on implementing strict authorization checks within the SysCategoryController delete handler. Developers must ensure that every deletion request is validated against a centralized permission service to confirm that the requesting user holds an administrative role or explicit ownership of the target resource. Additionally, access controls for the rootList and childList endpoints should be reviewed to prevent unauthorized enumeration of node IDs if such exposure poses a risk in specific deployment contexts. Implementing comprehensive logging and monitoring for deletion events can also aid in detecting potential abuse attempts early. Upgrading to a patched version that includes these security enhancements is essential to restore the integrity of access controls and protect dependent application structures from unauthorized modification or destruction.