CVE-2026-108646 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the...