Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Missing Authorization – deletion of message templates by any authenticated user
Action: Patch
AI Analysis

Impact

The vulnerability resides in the SysMessageTemplateController delete handler and represents a Missing Authorization flaw, allowing any authenticated user to delete system message templates. By leveraging the unprotected list endpoint, attackers can discover template identifiers and delete shipped notification templates, which can cause system notices and workflow reminders to fail. The affected component is part of the JeecgBoot platform.

Affected Systems

JeecgBoot, version 3.9.5 and below are impacted. The flaw was discovered in the SysMessageTemplateController of the Jeecg module system.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS information is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated session; an attacker with login credentials or access to a legitimate account can exploit the endpoint. Successful exploitation could lead to denial of notification services within the application, potentially disrupting business processes.

Generated by OpenCVE AI on October 11, 2026 at 15:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to JeecgBoot version 3.9.6 or later to apply the vendor fix
  • If upgrading is not immediately possible, disable the delete endpoint or add an authorization check to prevent unauthenticated deletion
  • Verify that all API endpoints enforce proper authentication and authorization controls

Generated by OpenCVE AI on October 11, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecgboot
Vendors & Products Jeecg jeecgboot

Sun, 11 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.
Title JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-862
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg Boot Jeecgboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T12:13:30.567Z

Reserved: 2026-10-11T13:35:28.621Z

Link: CVE-2026-108884

cve-icon Vulnrichment

Updated: 2026-10-18T12:04:08.799Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T15:16:55.533

Modified: 2026-10-18T13:16:32.883

Link: CVE-2026-108884

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:30:14Z

Weaknesses