CVE-2026-108880: JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

Q: Who can exploit this issue?

Any authenticated JeecgBoot user can exploit it. The attacker does not need elevated privileges or user interaction.

Q: What information does an attacker need to modify a dictionary?

The attacker needs the target dictionary's low_app_id. This value can be obtained through the GET /sys/dict/list endpoint and supplied as the lowAppId parameter or X-Low-App-ID header.

Q: What can a successful attacker change?

An attacker can rename low-code application dictionaries and replace their items. The provided data indicates integrity impact, with no stated confidentiality or availability impact.

Q: Which versions are known to be affected?

JeecgBoot through version 3.9.5 is affected. No fixed version is provided in the available data.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId parameter or X-Low-App-ID header to rename dictionaries and replace their items.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Event

via NVD·04:47 PM

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user can exploit it. The attacker does not need elevated privileges or user interaction.

What information does an attacker need to modify a dictionary?

The attacker needs the target dictionary's low_app_id. This value can be obtained through the GET /sys/dict/list endpoint and supplied as the lowAppId parameter or X-Low-App-ID header.

What can a successful attacker change?

An attacker can rename low-code application dictionaries and replace their items. The provided data indicates integrity impact, with no stated confidentiality or availability impact.

Which versions are known to be affected?

JeecgBoot through version 3.9.5 is affected. No fixed version is provided in the available data.

CVE-2026-108880: JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information does an attacker need to modify a dictionary?

What can a successful attacker change?

Which versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information does an attacker need to modify a dictionary?

What can a successful attacker change?

Which versions are known to be affected?