CVE-2026-108885: JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any syssms row, erasing records of sent notifications without ownership checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker needs network access to the affected JeecgBoot instance and valid credentials; no user interaction is required.
What does an attacker need to send?
The attacker can send DELETE requests to /sys/message/sysMessage/delete using arbitrary id values. The affected delete handler does not verify that the requester owns the targeted message record.
What is the impact of successful exploitation?
An attacker can delete any sys_sms message record, including records of sent notifications. This can erase notification history and affect the availability and integrity of those records.
How can I determine whether records may have been affected?
Review DELETE requests to /sys/message/sysMessage/delete and compare their id values with the authenticated users that made the requests. Deletions of message records by users who did not own those records are indicative of exploitation.