EUVD-2026-96564

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108625

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the sysMessage Edit endpoint. Low-privileged authenticated users can call PUT /sys/message/sysMessage/edit to modify message push records by providing any sys_sms record id . The lack of ownership checks allows att...