CVE-2026-108639: JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker needs network access to the application and the ability to send DELETE requests to the affected endpoint.
What is the impact of a successful exploit?
An attacker can permanently delete an active data dictionary and all of its items. The deletion bypasses the recycle bin, so the affected dictionary data is irreversibly removed.
How can defenders identify attempted exploitation?
Review application or HTTP access logs for DELETE requests to /sys/dict/deletePhysic/{id}, especially requests made by low-privileged accounts. Investigate whether the referenced dictionary IDs and their associated items are missing or were deleted unexpectedly.