The vulnerability is a missing authorization check on the PUT /sys/message/sysMessage/edit endpoint. Any authenticated user with low privileges can send a request naming any sys_sms record ID to overwrite the title, content, receiver address and send status. This flaw is a classic missing authorization weakness (CWE‑862) and primarily undermines data integrity, allowing attackers to alter or inject arbitrary messages, potentially deceiving recipients or disabling message delivery.

All releases of JeecgBoot up through version 3.9.5 are affected. The product is JeecgBoot and the vulnerable component is the sysMessage controller handling message edits.

The CVSS base score of 5.3 reflects moderate severity; exploitation requires authenticated access but does not provide remote code execution. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited exploitation data. Attackers would use standard authenticated HTTP requests to the exposed endpoint, so network exposure of the application could facilitate scanning and exploitation. The flaw compromises data integrity for message push records but not confidentiality or availability.