CVE-2026-108645 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the SysCategoryController component. This flaw specifically affects the /sys/category/edit endpoint, which is designed to handle updates to category dictionary nodes. The core issue lies in the absence of proper authorization checks that verify whether the authenticated user possesses the necessary privileges to modify system-wide classification data. In a secure implementation, such administrative functions should be restricted to users with elevated roles or specific permission sets. However, due to this missing authorization logic, any validly authenticated session can interact with this endpoint regardless of its assigned role level. This creates an insecure direct object reference scenario where the application trusts client-supplied identifiers without validating them against a server-side access control policy.
From a technical perspective, the exploitation vector involves sending POST or PUT HTTP requests to the vulnerable endpoint while supplying a target node identifier in the request payload. Because the backend does not enforce role-based restrictions on this operation, low-privileged attackers can successfully execute commands that rename categories, change their internal codes, or reposition them within the hierarchical structure of the sys_category table. These category nodes are foundational elements used across various forms and modules within the JeecgBoot framework to classify data entries. By altering these classification values, an attacker effectively manipulates how data is categorized and displayed throughout the application ecosystem. This capability allows for significant disruption of business logic that relies on accurate categorization, potentially leading to data integrity issues or misdirection of user inputs in downstream processes.
The operational impact of this vulnerability extends beyond simple configuration changes. Since category dictionaries are often referenced by multiple modules including reporting tools, form builders, and search functionalities, tampering with these nodes can cause widespread functional degradation. Attackers might use this capability to inject misleading categories that confuse end-users or administrators, thereby facilitating social engineering attacks or obscuring malicious activities within the system logs. Furthermore, if sensitive data is associated with specific category codes, altering those codes could result in unauthorized access patterns where users inadvertently view or edit records belonging to other classifications due to the broken mapping logic. This undermines the confidentiality and integrity of the application's data model without requiring any elevation of privileges beyond basic authentication.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, as well as CWE-639 regarding Authorization Bypass Through User-Controlled Key. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078, specifically the Valid Accounts subcategory where attackers leverage existing credentials to perform unauthorized actions. The ability to modify system-wide settings via a web interface also touches upon aspects of configuration manipulation that can persist across sessions if not properly audited or rolled back by administrative oversight mechanisms.
To mitigate this risk, developers must implement strict role-based access control checks on the SysCategoryController endpoints before processing any modification requests. This involves verifying that the current user session holds specific permissions required for managing category dictionaries, such as an admin-level flag or a dedicated management privilege token. Additionally, implementing input validation to ensure that only authorized node identifiers are processed can provide defense in depth. Regular security audits of controller methods should be conducted to identify similar patterns where business logic endpoints lack adequate authorization guards. Updating the framework to version 3.9.6 or later is recommended as it addresses these access control deficiencies by enforcing proper permission checks on administrative functions, thereby restoring the integrity of the application's role-based security model.