CVE-2026-108645

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController component. This vulnerability allows any authenticated user to access the /sys/category/edit endpoint. By sending POST or PUT requests with a specific node ID, low-privileged attackers ...

CVE-2026-108645 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move...

PT-2026-109906

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysCategoryController that allows authenticated users to modify category dictionary nodes. By sending POST or PUT requests to the '/sys/category/edit' endpoint a...