EUVD-2026-96578

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-108639 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-108639

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDictController component. Specifically, the deletePhysic handler fails to perform adequate permission checks, allowing any authenticated user to send DELETE requests to /sys/dict/deletePhysic/{id}. This vuln...