CVE-2026-108625: JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiver address and send status without ownership checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it over the network. No user interaction is required.
What access and information does an attacker need?
The attacker needs a valid low-privileged account and the ID of a target sys_sms message record. They can submit that ID in a PUT request to the sysMessage edit endpoint.
Which message fields can be modified?
An attacker can overwrite the message title, content, receiver address, and send status. The endpoint does not perform ownership checks on the referenced sys_sms record.
How can defenders identify possible exposure or abuse?
Review authenticated PUT requests to /sys/message/sysMessage/edit, especially requests made by low-privileged accounts. Compare changed sys_sms records against expected owners and look for unexpected changes to titles, content, recipient addresses, or send status.