CVE-2026-108625

Received Received - Intake

Missing Authorization in JeecgBoot Allows Message Push Modification

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108625

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can modify message push records by sending a PUT request to /sys/message/sysMessage/edit. They can overwrite any sys_sms record's title, content, receiver address, and send status without verifying ownership.

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to the endpoint /sys/message/sysMessage/edit. Check for requests modifying sys_sms records without proper ownership validation. Review application logs for unauthorized modifications to message push records.

Impact Analysis

Attackers with low privileges could alter message content, impersonate legitimate communications, or manipulate message statuses. This could lead to misinformation, unauthorized data access, or disruption of notification systems.

Compliance Impact

This vulnerability could violate integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized message modifications may lead to data breaches, loss of audit trails, or non-compliance with record-keeping and access control mandates.

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later. Implement strict access controls to ensure only authorized users can modify message push records. Add input validation to prevent unauthorized record edits.

Hi! I’m here to help you understand CVE-2026-108625. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70