CVE-2026-108626: JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user with low privileges can exploit it. The attacker needs to be able to send a GET request to the sysMessage queryById endpoint and provide record identifiers.
What information can be exposed?
An attacker can read message push records belonging to other users. The disclosed data includes message content and receiver addresses.
Are unauthenticated attackers affected?
The available information describes exploitation by authenticated low-privileged users. It does not indicate that unauthenticated access is sufficient.
How can I check for exposure?
Review access to GET /sys/message/sysMessage/queryById and determine whether a low-privileged account can retrieve message records by supplying IDs for records it does not own.