The vulnerability in JeecgBoot versions up to 3.9.5 permits any authenticated user to access the SysCategoryController /importExcel endpoint without proper authorization checks. Through this endpoint, an attacker can upload crafted Excel workbooks that are parsed and inserted into the system-wide sys_category dictionary, creating arbitrary category nodes. This is a CWE‑862 missing authorization vulnerability, which allows the attacker to alter system configuration objects and potentially manipulate application behavior by adding or modifying categories that affect other components.

JeecgBoot up to and including version 3.9.5.

The CVSS score of 5.3 indicates a medium impact risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation probability. The attack vector requires a valid authenticated session; an attacker with any user privileges can exploit the missing authorization to upload Excel files and achieve unauthorized data manipulation. No additional network-level requirements are stated in the description.