EUVD-2026-96564

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

EUVD-2026-96556

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

EUVD-2026-96557

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

EUVD-2026-96558

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108625

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108619

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108618

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

CVE-2026-108617

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-108625

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the sysMessage Edit endpoint. Low-privileged authenticated users can call PUT /sys/message/sysMessage/edit to modify message push records by providing any sys_sms record id . The lack of ownership checks allows att...

CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

CVE-2026-108618

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the sysMessageTemplate edit endpoint. Low-privileged authenticated users can exploit the PUT /sys/message/sysMessageTemplate/edit request to overwrite system notification titles and content. Attackers c...

CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

PT-2026-109886

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message push records due to missing authorization. By calling the endpoint "PUT /sys/message/sysMessage/edit", an attacker can provide any sys sms reco...

CVE-2026-108617: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

PT-2026-109879

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message templates due to missing authorization. By accessing the unguarded list endpoint to obtain template IDs, an attacker can use the PUT...

PT-2026-109880

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete message templates due to missing authorization. This is possible via the 'DELETE /sys/message/sysMessageTemplate/deleteBatch' endpoint. By providing...