JeecgBoot versions up to 3.9.5 contain an authorization bypass in the SysMessageController deleteBatch endpoint. The flaw allows authenticated users with low privileges to delete message push records, including those queued for delivery. This can lead to loss of communication data and potentially impact the integrity of the system. The vulnerability is an example of missing authorization (CWE‑862).

JeecgBoot application, versions 3.9.5 and earlier. No specific sub‑modules other than the system module were identified as vulnerable.

The CVSS score of 5.3 indicates medium severity and the EPSS score is not available, which means that the likelihood of exploitation cannot be quantified from this advisory. Because the issue is not in the CISA KEV catalog, there is no known active exploitation associated with this CVE at this time. Attackers must first authenticate to the system, then they can retrieve message identifiers from the unrestricted listing endpoint. With those identifiers they can call deleteBatch and remove an arbitrary number of message records because the endpoint performs no authorization check, giving the attacker unauthorized deletion ability within the application.