CVE-2026-108880: JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId parameter or X-Low-App-ID header to rename dictionaries and replace their items.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user can exploit it. The attacker does not need elevated privileges or user interaction.
What information does an attacker need to modify a dictionary?
The attacker needs the target dictionary's low_app_id. This value can be obtained through the GET /sys/dict/list endpoint and supplied as the lowAppId parameter or X-Low-App-ID header.
What can a successful attacker change?
An attacker can rename low-code application dictionaries and replace their items. The provided data indicates integrity impact, with no stated confidentiality or availability impact.
Which versions are known to be affected?
JeecgBoot through version 3.9.5 is affected. No fixed version is provided in the available data.