JeecgBoot CVE-2026-108622

Requires a valid authenticated session on the JeecgBoot application at any privilege level (PR:L) - exploitation is NOT possible unauthenticated. The specific prerequisites are: (1) network access to the application, and (2) the ability to reach the /sys/log/list endpoint (described as unguarded) to obtain sys_log record IDs and the SysLogController delete handler, which lacks an authorization check. No special non-default configuration, user interaction, or elevated role is needed beyond holding any login. The primary limiting factor is therefore the need for valid credentials, which confines risk to deployments that provision low-trust or self-registering accounts or that are exposed to a population of untrusted authenticated users; the impact is limited to deletion of audit log entries (integrity/availability of logs) with no confidentiality exposure.

This is a genuine but modest-severity integrity/anti-forensics issue rather than a top-tier priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low attack complexity, and crucially PR:L - the attacker must already hold a valid low-privileged account. CWE-862 (Missing Authorization) matches the described broken access control on the delete handler. Signal cross-reference: a public POC exists (VulnCheck advisory plus a GitHub exploit script), which raises operational realism, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread automated exploitation - treat POC availability and active exploitation as distinct signals. The impact is deliberately scoped to integrity and availability of audit data (VC:N - no confidentiality impact), so the real danger is secondary: an attacker who has already compromised a low-privilege account can erase the forensic trail of their other actions, hampering detection and incident response. On its own it does not grant code execution, data theft, or privilege escalation. Net: a credible defense-in-depth/log-integrity concern for exposed JeecgBoot instances with untrusted authenticated users, but not an emergency compared to unauthenticated RCE-class issues. Note the input Tag 'Authentication Bypass' is imprecise - this is missing authorization for an already-authenticated user, not an authentication bypass.

A low-privileged but authenticated JeecgBoot user (e.g., a basic account on an internet-facing instance) performs malicious actions, then calls the unguarded /sys/log/list endpoint to enumerate sys_log entry IDs and issues delete requests to the SysLogController delete handler to remove the records documenting their activity. A public POC (poc_log_delete.py) automates this. Because the CVSS vector is AV:N/AC:L/PR:L, exploitation is remote and technically easy but requires valid credentials.