CVE-2026-108624: JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs a low-privileged authenticated account. No user interaction is required.
What records can be deleted?
The flaw allows deletion of any message push records, including messages that are still queued for delivery. Attackers can obtain target record IDs through the unguarded list endpoint.
How can I determine whether the affected functionality is exposed?
Review access to the SysMessageController list and deleteBatch handlers. If low-privileged users can retrieve message record IDs and submit them to deleteBatch, they can delete message records outside their authorization scope.