EUVD-2026-96556

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

EUVD-2026-96558

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108617

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) affecting the sysMessageTemplate/add endpoint. A low-privileged authenticated user can call POST /sys/message/sysMessageTemplate/add to insert arbitrary notification templates into the shared sys_sm...