CVE-2026-108623: JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire syslog table, erasing all users' audit trails.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. No user interaction is required.
What access and request are required to erase audit logs?
An attacker needs valid authenticated access and the ability to send a DELETE request to the SysLogController deleteBatch endpoint. Setting the ids parameter to allclear wipes the entire sys_log table.
How can I determine whether audit logs may already have been deleted?
Check whether the sys_log table is unexpectedly empty or has unexplained gaps in audit history. The reported attack erases all entries, so external log copies or database backups may be needed to investigate prior activity.