JeecgBoot versions up to 3.9.5 exhibit a missing authorization weakness (CWE‑862) on the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Authenticated users with low privileges can supply a list of template identifiers and cause deletion of sys_sms_template rows. This results in the loss of notification templates, breaking workflow reminders and other template‑based communications, and undermines the integrity of the application’s message handling.

The vulnerability affects the JeecgBoot platform, specifically the message module of JeecgBoot systems using version 3.9.5 or earlier. The impacted API is the sysMessageTemplate deleteBatch operation exposed by the JeecgBoot framework.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires the attacker to be an authenticated user, but no higher privileges are needed. Because the endpoint is unguarded, any authenticated session can perform deletions, making this a low‑barrier privilege escalation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently known to be actively exploited in the wild. Nonetheless, an attacker can achieve non‑repudiation and availability impact by permanently removing critical message templates.