CVE-2026-108618: JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker needs network access to the JeecgBoot application and a valid low-privileged account.
What does an attacker need to modify message templates?
The attacker can obtain template identifiers from the unguarded list endpoint, then submit a PUT request to /sys/message/sysMessageTemplate/edit. No additional user interaction is required for the template modification itself.
What is the practical impact of a successful exploit?
An attacker can overwrite system notification titles and content. This can cause other users to receive attacker-controlled text or links in system notifications.