CVE-2026-108884: JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit the missing authorization check. No user interaction is required.
What access or information does an attacker need?
The attacker needs valid authenticated access and message-template identifiers. Template IDs can be obtained from the unguarded list endpoint.
What is the operational impact of exploitation?
An attacker can delete message templates, including shipped notification templates. This can cause system notices and workflow reminders to stop functioning.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.