CVE-2026-108643 — JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/categ…
Published: 2026-10-10 · CVSS: 5.3 · CVSS 4.0
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7