CVE-2026-108646 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, including under existing parent nodes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5 and specifically targets the SysCategoryController component responsible for handling data import operations via Excel files. This vulnerability is classified as a missing authorization issue, which fundamentally represents an Access Control failure where the application fails to properly verify whether the authenticated user possesses the necessary privileges to perform specific actions on protected resources. In this context, the system-wide sys_category dictionary serves as a critical configuration structure that defines hierarchical categories used throughout the application for data organization and filtering. The importExcel handler within SysCategoryController is designed to accept Excel workbooks containing category definitions and parse them into database records. However, due to insufficient access control checks, this endpoint does not validate if the requesting user has administrative rights or specific permissions required to modify system-level dictionary entries.
This architectural oversight allows any authenticated user, regardless of their assigned role or privilege level, to execute bulk insertions into the sys_category table. By uploading a crafted Excel workbook containing arbitrary node definitions, an attacker can inject new category entries directly into the database structure. The vulnerability is particularly severe because it permits insertion under existing parent nodes, effectively allowing low-privileged users to manipulate the hierarchical tree of categories that governs data visibility and organization across the entire platform. This capability bypasses standard administrative workflows intended for managing system configurations, thereby undermining the integrity of the application's metadata layer.
The operational impact of this vulnerability extends beyond simple database manipulation. Since category dictionaries often influence how data is displayed, filtered, and accessed by other users within the system, an attacker can create misleading or malicious categories that may be used to obfuscate illicit activities or disrupt normal business operations. Furthermore, if these categories are linked to specific permissions or access rules in downstream modules, their manipulation could lead to broader privilege escalation scenarios where attackers gain unauthorized visibility into sensitive data sets associated with those newly created nodes. This aligns with the Common Weakness Enumeration standard CWE-269, which describes Improper Privilege Management, and maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized administrative functions without requiring credential theft or exploitation of a separate software bug.
To mitigate this risk, developers must implement strict role-based access control checks within the SysCategoryController's importExcel method before processing any uploaded files. The application should verify that the current user holds an administrator role or a specific permission token designated for managing system dictionaries. Additionally, input validation mechanisms should be strengthened to ensure that only authorized entities can modify core configuration tables like sys_category. Regular security audits and static code analysis focused on access control logic are recommended to prevent similar authorization bypasses in other controllers within the framework.