The vulnerability in JeecgBoot allows a legitimate authenticated user with any role to invoke the /sys/category/edit endpoint and modify sys_category nodes. By supplying a node identifier, an attacker can rename, recode, or move category dictionary entries that are used across forms and other application components. The missing authorization check (CWE‑862) results in a breach of data integrity, potentially causing the application to misclassify data, present incorrect information to users, or expose sensitive data through altered form behavior.

All installations of JeecgBoot up to and including version 3.9.5 are affected. The flaw is present in the SysCategoryController component of the JeecgBoot product and any deployment that has not upgraded beyond the documented fixed version would be vulnerable.

The CVSS v3.1 score of 5.3 classifies this flaw as moderate severity. No EPSS metric is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication, but a low‑privileged user can gain full control over system‑wide category entries. While no public exploit has been documented, the ability to alter classification values can disrupt business logic and data handling, making this risk significant for organizations relying on the affected product.