CVE-2026-108624
JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 10, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 10, 2026
Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
JeecgBootjeecgboot |
|
References
- Researcher Proof of Conceptexploit
- Vulnerable Code (v3.9.5)technical-description
- VulnCheck Advisory: JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.