CVE-2026-108619

Received Received - Intake

JeecgBoot Missing Authorization Leading to Message Template Deletion

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108619

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can delete message templates by sending a DELETE request to /sys/message/sysMessageTemplate/deleteBatch with comma-separated template IDs. This allows attackers to delete all sys_sms_template rows, disrupting template-based notifications like workflow reminders.

Detection Guidance

Check for unauthorized DELETE requests to /sys/message/sysMessageTemplate/deleteBatch with low-privileged accounts. Monitor logs for bulk deletions of sys_sms_template rows or missing authorization errors on this endpoint.

Impact Analysis

This vulnerability allows low-privileged users to delete critical message templates, breaking notifications such as workflow reminders. This could disrupt business processes relying on automated messaging and cause operational delays.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized deletion of message templates. If templates contain sensitive data or notifications related to personal data processing or healthcare communications, their deletion could disrupt required documentation or notifications, potentially violating regulatory requirements for data integrity and communication.

Mitigation Strategies

Apply patches or updates to JeecgBoot version 3.9.5 or later. Restrict access to the /sys/message/sysMessageTemplate/deleteBatch endpoint via network policies or application-level controls. Review and audit user permissions to ensure least privilege.

Hi! I’m here to help you understand CVE-2026-108619. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70