7 matches found
PT-2026-110207
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys sms row, erasing records of sen...
CVE-2026-108624
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...
CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...
CVE-2026-108624
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...
CVE-2026-108624
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController deleteBatch handler. This vulnerability allows low-privileged authenticated users to delete message records by obtaining record IDs from an unguarded list endpoint and submitting them to th...
PT-2026-109885
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysMessageController. This issue allows authenticated users with low privileges to delete message push records, including those pendin...
CVE-2026-108624: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...