CVE-2026-108645: JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide syscategory nodes, altering classification values used across forms.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need user interaction and can reach the affected endpoint over the network.
What access and request capabilities are required?
The attacker needs a valid authenticated account and the ability to send a POST or PUT request to /sys/category/edit. They supply the identifier of a sys_category node they want to modify.
What changes can an attacker make?
An attacker can rename, recode, or move system-wide category dictionary nodes. This can alter classification values used across forms, affecting the integrity of application data and workflows.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.