CVE-2026-108622

The JeecgBoot framework (through version 3.9.5 ) is affected by a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user to delete audit log entries. An attacker with low privileges can exploit this by first obtaining log IDs from the u...

CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...