CVE-2026-108624

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController deleteBatch handler. This vulnerability allows low-privileged authenticated users to delete message records by obtaining record IDs from an unguarded list endpoint and submitting them to th...

CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

CVE-2026-108625

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the sysMessage Edit endpoint. Low-privileged authenticated users can call PUT /sys/message/sysMessage/edit to modify message push records by providing any sys_sms record id . The lack of ownership checks allows att...

CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108623 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire syslog table,...

CVE-2026-108623 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire syslog table,...

CVE-2026-108623

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysLogController deleteBatch handler. This vulnerability allows any authenticated user to delete system audit log entries. Specifically, low-privileged attackers can execute a DELETE request with ids set to all...

CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108622

The JeecgBoot framework (through version 3.9.5 ) is affected by a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user to delete audit log entries. An attacker with low privileges can exploit this by first obtaining log IDs from the u...

CVE-2026-108621 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests t...

CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108621 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests t...

CVE-2026-108621

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController edit handler. This vulnerability allows any authenticated user to modify organizational positions by sending PUT or POST requests to the /sys/position/edit endpoint. A low-privileged attac...

CVE-2026-108620 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108620 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108620

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController deleteBatch handler. This vulnerability allows any authenticated user to delete organizational positions by sending comma-separated position IDs. Attackers can first obtain the...

CVE-2026-108619 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108619

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the sysMessageTemplate component. Specifically, the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint fails to properly restrict access, allowing low-privileged authenticated users to delete mes...