A function within the /api/admin/sys-message/ endpoint of feiyuchuixue sz-boot-parent permits an attacker to modify the messageId parameter, thereby bypassing the application’s authorization checks. This flaw, classified as CWE-285 and CWE-639, enables a remote user to retrieve system messages that belong to other users, exposing potentially sensitive data. The vulnerability can be exploited simply by sending a crafted HTTP request; authentication beyond a valid user session is unnecessary.

Affected products include all released versions of sz-boot-parent from the initial release up through 1.3.2‑beta. The component that hosts the /api/admin/sys-message/ endpoint contains the mis‑implementation, and the public exploit suggests that a 64‑bit integer range or similar enumeration can be abused. In 1.3.3‑beta the developers added a message‑ownership check to mitigate the issue.

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the attack vector is remote and leverages a public exploitation script, any exposed system is susceptible unless the endpoint is properly shielded or patched.