CVE-2026-108619: JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all syssmstemplate rows, breaking template-based notifications such as workflow reminders.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it. The attacker does not need user interaction and can reach the affected endpoint over the network.
What does an attacker need to delete message templates?
The attacker needs valid low-privileged authentication and template IDs. IDs can be obtained from the unguarded list endpoint, then supplied as comma-separated values to the deleteBatch endpoint.
What is the operational impact if the issue is exploited?
An attacker can delete all sys_sms_template rows. This can disrupt template-based notifications, including workflow reminders.