CVE-2026-108622: JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to erase traces of their actions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker needs network access to the application and valid credentials; no user interaction is required.
How would an attacker identify logs to delete?
The /sys/log/list endpoint is unguarded, allowing a low-privileged authenticated attacker to obtain audit-log identifiers. Those identifiers can then be supplied to the /sys/log/delete handler to remove selected sys_log records.
What is the practical impact?
An attacker can delete audit log entries, affecting the integrity and availability of audit records. This can erase evidence of the attacker’s actions and hinder incident investigation.
How can defenders determine whether they may already be affected?
Review whether JeecgBoot is deployed at version 3.9.5 or earlier and whether authenticated low-privileged accounts can access /sys/log/list and delete records through /sys/log/delete. Investigate unexpected gaps or missing entries in sys_log records, particularly for activity associated with low-privileged accounts.