The vulnerability occurs in the SysLogController delete handler of JeecgBoot 3.9.5 and earlier. It omits an authorization check, permitting any authenticated user to call the /sys/log/delete endpoint. This allows attackers to remove audit log entries, erasing obvious traces of their activity. The problem is a classical example of the Absence of Authorization weakness (CWE‑862), a vulnerability that undermines the integrity of application logs and forensic evidence but does not expose sensitive data directly.

Affected systems include the JeecgBoot application up to version 3.9.5. The vulnerability is present in all builds that ship the SysLogController module as distributed by jeecg:JeecgBoot. Variant distributions using the same controller code are also affected. Exact affected products are identified by the vendor product name JeecgBoot; no specific sub‑components are listed beyond the version.

The CVSS score of 5.3 places the flaw at moderate severity; the attack requires authenticated access, which an adversary can obtain through legitimate credentials or credential compromise. The missing authorization allows any authenticated user to enumerate audit‑log identifiers by invoking /sys/log/list and then deletions via /sys/log/delete. Because EPSS data is unavailable, the probability of exploitation cannot be quantified, but the absence from CISA's KEV catalog indicates no widespread exploitation to date. Nevertheless, the loss of audit trail information represents a serious operational risk that can assist attackers in remaining undetected. The overall risk is elevated for environments that rely upon audit logs for incident response and compliance.