JeecgBoot CVE-2026-108617

Requires a valid authenticated session with any low-privileged role (PR:L); no administrative rights are needed. The specific prerequisite is that the POST /sys/message/sysMessageTemplate/add endpoint in SysMessageTemplateController lacks a function-level authorization check, so any logged-in user can invoke it against default configurations of JeecgBoot through 3.9.5. Limiting factors: the attacker must first obtain credentials/a session (so it is not remote-unauthenticated), there is no user interaction required, and impact is limited to injecting templates into the shared sys_sms_template store rather than directly compromising hosts or data.

This is a medium-severity authorization flaw, not an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree with the description: exploitation is network-reachable and low-complexity, but it requires an authenticated low-privileged account (PR:L), which materially limits the attacker population to users who already have some foothold. Impact is confined to integrity (VI:L); there is no confidentiality (VC:N) or availability (VA:N) impact and no scope change (SC/SI/SA:N), consistent with inserting notification templates rather than achieving code execution or data theft. A public POC exists (reported by VulnCheck, with a GitHub exploit script), so the barrier to weaponization is low - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent (no CVSS-vs-description conflict), but the real-world danger depends heavily on secondary use: a planted template could be leveraged for phishing/social-engineering content delivered through the system's trusted email/SMS/IM channels, which is the realistic escalation path beyond the raw 'low integrity' label. EPSS is missing, so widespread automated exploitation cannot be estimated from the data provided.

A user holding only a minimal, non-administrative role in a JeecgBoot deployment sends an authenticated POST request to /sys/message/sysMessageTemplate/add and inserts a notification template with an attacker-chosen code and content. Because the shared sys_sms_template library feeds system, email, SMS and IM notifications, the planted template can later be delivered to other users as seemingly legitimate platform messaging (e.g., phishing or misleading content). A public Python POC for this exact endpoint is available on GitHub, so exploitation requires little effort given valid low-privilege credentials.