EUVD-2026-96558
GHSA-x973-qqpx-mc8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate template IDs via unguarded list endpoint
-
ExecutionCall deleteBatch with comma-separated IDs
-
ImpactDelete all sys_sms_template rows and break notifications
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated JeecgBoot session for any low-privileged user (PR:L) - it is NOT remote-unauthenticated. The attacker needs reachability to the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint and uses the separately unguarded template list endpoint to obtain valid template IDs; no special non-default configuration, no user interaction, and no admin role are required against default deployments of JeecgBoot through 3.9.5. The practical limiting factors are therefore the need for any authenticated account and network access to the management API; impact is confined to deletion of sys_sms_template rows (loss of notification/template integrity and availability), with no confidentiality exposure. |
| Impact | This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the matching CVSS 3.1 reading show a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account and no user interaction, but with no confidentiality impact and only low integrity/availability impact (VI:L/VA:L) - consistent with the 5.3 base score. Publicly available exploit code exists (VulnCheck-reported PoC), which raises operational likelihood, but there is no CISA KEV listing and no EPSS value was supplied, so there is no evidence of active, widespread exploitation - this is best treated as a credentialed, targeted data-destruction/denial-of-function issue rather than an unauthenticated internet-scale threat. The signals are internally consistent (PR:L authentication requirement aligns with the description's 'low-privileged authenticated users'), so no major conflict exists; the main missing data points are EPSS probability and KEV status, both of which appear simply absent rather than contradictory. Net: patch during a normal cycle, prioritizing instances exposed to many low-trust authenticated users. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user queries the unguarded message-template list endpoint to harvest valid template IDs, then issues a DELETE to /sys/message/sysMessageTemplate/deleteBatch with those IDs comma-separated, wiping all sys_sms_template rows and breaking template-based notifications such as workflow reminders. A public PoC (poc_console_delete_routes.py) demonstrates this, and because PR:L authentication is the only barrier, any ordinary account can perform it without further escalation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any low-privileged authenticated user delete SMS message templates by issuing a DELETE request to /sys/message/sysMessageTemplate/deleteBatch with comma-separated IDs harvested from the separately unguarded template list endpoint. The result is integrity and availability loss confined to the sys_sms_template table - deletion of all template rows breaks template-driven notifications such as workflow reminders - with no confidentiality exposure, making this a genuine but moderate-severity issue rather than a top-priority emergency. Publicly available exploit code exists (a PoC script deleting routes is published on GitHub), but there is no confirmation of active exploitation (not in CISA KEV), and exploitation still requires a valid authenticated session plus network reachability to the management API.
RemediationAI
No vendor-released patch identified at time of analysis: the 3.9.5 line is the last confirmed affected release and no fixed version number appears in the available advisory data, so administrators should track the upstream project and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-deletebatch-endpoint) and apply a patched build as soon as it is published. Until then, the highest-value compensating control is to enforce authorization on the SysMessageTemplateController deleteBatch handler (and its list counterpart) at the application or gateway layer, requiring an administrative role for any delete on /sys/message/sysMessageTemplate/deleteBatch; this restores the intended permission model but requires custom code changes that must be re-validated after every upgrade. As a network-level mitigation, block or restrict the DELETE /sys/message/sysMessageTemplate/deleteBatch and the associated list endpoint at a reverse proxy or WAF to trusted administrative source ranges - the trade-off is that legitimate template management from other networks breaks, and path-normalization or method-override bypasses must be tested. Reduce the blast radius by removing delete privileges from low-privileged roles, auditing and alerting on bulk deletes of sys_sms_template, and keeping recent database backups of the sys_sms_template table so deleted notification templates used by workflow reminders can be restored quickly; backups are a recovery measure, not a prevention one. Generic hardening such as isolating the JeecgBoot management API from untrusted networks also limits exposure, since exploitation requires a valid authenticated session and reachability to the management endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose system module exposes REST controllers under /sys/**, including SysMessageTemplateController (jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java, lines 118-122), which implements the deleteBatch operation. The root cause is CWE-862 (Missing Authorization): the deleteBatch handler performs no permission or role check on the caller, so the server-side authorization decision that should gate destructive operations on sys_sms_template records is absent. Because the companion list endpoint is likewise unguarded, an authenticated low-privilege account can enumerate every template ID and then submit them in a single comma-separated deleteBatch call, deleting the entire sys_sms_template table content. This is a web-API authorization flaw in the Java application layer rather than a memory-safety or injection issue; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the independently assessed CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) agree that the attacker must be authenticated, needs no user interaction, and that impact is limited to low integrity and availability loss.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable management endpoint with a low-privileged authenticated account (PR:L) and no UI; no data disclosure (C:N), but unauthorized row deletion gives limited integrity and availability impact (I:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB