Missing authorization in JeecgBoot's SysCategoryController delete handler permits any authenticated user to delete category dictionary nodes. The flaw enables low‑privileged attackers to retrieve node identifiers from exposed rootList and childList endpoints and remove entire sys_category subtrees, which can break dependent forms and dictionary fields. This weakness is captured by CWE-862 and results in unauthorized data removal that may disrupt application functionality.

JeecgBoot version 3.9.5 and earlier are susceptible. All installations running these releases without a newer version or a corrective patch face the described deletion risk.

The vulnerability carries a CVSS score of 5.3, indicating a moderate impact. The EPSS score is not available, and the issue is not listed in CISA KEV. Because a valid user session is required, the likely attack vector is authenticated. An attacker with simple credentials can delete category nodes and trigger cascading failures in related forms. While the flaw does not provide remote code execution, the loss of critical configuration data can severely impede usability and may serve as an escalation path if further credentials are harvested.