JeecgBoot versions up to 3.9.5 allow an attacker who can authenticate to the system to delete data dictionaries permanently by calling the deletePhysic endpoint. The vulnerability stems from an authorization bypass that permits any authenticated user to invoke the endpoint, resulting in irreversible removal of the dictionary and all its items. The weakness is identified as CWE‑862, a missing authorization issue that impacts data integrity and availability.

All installations of JeecgBoot up to version 3.9.5 are affected. The vulnerability is present in the SysDictController component because the deletePhysic method lacks proper access control. Administrators and users with ordinary privileges can trigger the deletion when authenticating to the platform. No specific sub‑component versions beyond the 3.9.5 release are listed; earlier releases are presumed not affected unless otherwise documented.

The CVSS score of 5.3 indicates a moderate severity based on the impact on confidentiality and integrity. Since the EPSS score is unavailable, the likelihood of exploitation cannot be quantified, but the absence of additional security controls on this endpoint makes it feasibly exploitable by authenticated users. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in the wild. Attackers would need the ability to obtain valid credentials and send a DELETE request to /sys/dict/deletePhysic/{id}, a straightforward HTTP operation in most web client tools.