Missing Authorization in JeecgBoot Allows Dictionary Modification

Executive Summary

CVE-2026-108880 is a missing authorization vulnerability in JeecgBoot through version 3.9.5. It affects the PUT /sys/dict/editDictByLowAppId endpoint, which allows any authenticated user to modify low-code application dictionaries without proper access controls. Attackers can exploit this by first retrieving a dictionary's low_app_id via the unauthenticated GET /sys/dict/list endpoint, then using it to rename dictionaries or replace their items through the vulnerable endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the PUT /sys/dict/editDictByLowAppId endpoint is accessible without proper authorization. First, use GET /sys/dict/list to retrieve lowAppId values. Then attempt to modify a dictionary using the obtained lowAppId via the PUT endpoint. If successful without proper access controls, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with authenticated access to modify or rename dictionaries belonging to other low-code applications. This could lead to unauthorized changes in application behavior, data corruption, or disruption of services relying on those dictionaries. Attackers may also replace dictionary items, potentially altering system configurations or exposing sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modifications to data dictionaries, potentially leading to data integrity issues or unauthorized access to sensitive information. GDPR requires data integrity and security measures, while HIPAA mandates strict access controls for protected health information. Exploitation of this flaw may violate these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5. Implement strict authorization checks on the PUT /sys/dict/editDictByLowAppId endpoint. Restrict access to the GET /sys/dict/list endpoint to prevent exposure of lowAppId values. Monitor for unauthorized dictionary modifications.

Useful 0 Not Useful 0