CVE-2026-108644 jeecgboot CVE debrief

Who should care

Defenders and administrators of systems using JeecgBoot, especially those with low-privileged user access to the affected endpoints, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108644 is a missing authorization vulnerability in JeecgBoot through 3.9.5, allowing low-privileged users to delete category dictionary nodes. Defenders should verify exposure, prioritize remediation, and implement compensating controls.

• Potential unauthorized deletion of category dictionary nodes by low-privileged users.
• Disruption of dependent forms and dictionary fields due to deleted sys_category subtrees.
• Need for verification of affected versions and exposure in the environment.
• Priority on implementing compensating controls and monitoring for abuse.

Technical summary

The vulnerability exists in the SysCategoryController delete handler of JeecgBoot through 3.9.5. Any authenticated user can delete category dictionary nodes, which can lead to the deletion of entire sys_category subtrees, affecting dependent forms and dictionary fields. This could allow low-privileged attackers to obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields. Defenders should verify exposure, prioritize remediation, and implement compensating controls.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected endpoints.

Recommended defensive actions

• Verify the affected versions of JeecgBoot and check if the system is using version 3.9.5 or earlier.
• Restrict access to the SysCategoryController delete handler to authorized users only.
• Monitor the unguarded rootList and childList endpoints for potential abuse.
• Implement compensating controls to detect and prevent unauthorized deletion of category dictionary nodes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions beyond 3.9.5, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.