The vulnerability is a missing authorization flaw that permits any authenticated user, even with low privileges, to delete category dictionary entries by sending a DELETE request to the /sys/category/deleteBatch endpoint. Attackers can first discover category identifiers through the unprotected rootList and childList endpoints and then submit those ids to recursively remove entire sys_category subtrees. This can corrupt dependent forms and dictionary fields, leading data loss and functional disruption.

JeecgBoot products up to and including version 3.9.5 are affected. The flaw is present in the JeecgBoot code base, specifically in the SysCategoryController handling deleteBatch operations.

With a CVSS score of 5.3 and no EPSS score available, the risk is moderate. The vulnerability has not been listed in the CISA KEV catalog, indicating limited known exploitation activity. Attackers can exploit the flaw through authenticated HTTP requests to the deleteBatch endpoint after enumerating IDs via rootList or childList, causing unauthorized data deletion and potential service disruption. Because the flaw requires authentication, the attacker must have valid login credentials, but any such credentials suffice regardless of privilege level.