JeecgBoot through 3.9.5 contains a missing authorization flaw in the SysMessageController queryById handler. This allows any authenticated user, even with low privileges, to retrieve arbitrary message push records by supplying an id to the GET /sys/message/sysMessage/queryById endpoint. The attacker can read the message content and the receiver addresses of other users, which constitutes a confidentiality breach.

Installed instances of JeecgBoot up to and including version 3.9.5 are affected. The flaw resides in the sysMessage controller component of the application.

The CVSS v3 base score is 5.3, indicating a moderate severity. EPSS data is not available, so current exploitation likelihood cannot be quantified. The flaw is not listed in the CISA KEV catalog. Attackers need only authenticated credentials to exploit the missing authorization; the endpoint accepts arbitrary IDs, so any user with access can enumerate message records. The impact is limited to confidential data disclosure, and no privilege escalation or code execution is possible.