CVE-2026-108617: JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared syssmstemplate library used for system, e-mail, SMS and IM notifications.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user with only minimal privileges may be able to exploit it. The vulnerable action is reachable over the network through a POST request to /sys/message/sysMessageTemplate/add.
What can an attacker do after exploiting it?
An attacker can create arbitrary notification templates in the shared sys_sms_template library. They can choose template codes and content used for system, e-mail, SMS, and IM notifications.
How can defenders check for possible exploitation?
Review message-template creation records and the sys_sms_template library for unexpected templates, especially unfamiliar codes or notification content. Investigate creations associated with low-privileged accounts and requests to POST /sys/message/sysMessageTemplate/add.