EUVD-2026-96562
GHSA-6vff-68pc-g8vm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any authenticated JeecgBoot account
-
ExploitSend DELETE to SysLogController deleteBatch with ids=allclear
-
ExecutionServer deletes all sys_log rows
-
ImpactDestroy all users' audit trails
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the JeecgBoot application at any privilege level (PR:L) - the deleteBatch handler in SysLogController performs no authorization check (CWE-862), so any logged-in user, not just an admin, can invoke it. The specific trigger is a DELETE request to the log batch-delete endpoint with the ids parameter set to the special value 'allclear', which clears the whole sys_log table rather than selected rows. Limiting factors: exploitation is impossible for fully unauthenticated outsiders (an account is needed), and the impact is confined to the audit-log table - no other data, no code execution, and no privilege escalation. Affects JeecgBoot versions through 3.9.5. |
| Impact | This is a genuine but bounded risk rather than a top-tier emergency. The CVSS 4.0 base score of 7.1 is driven almost entirely by the integrity metric (VI:H) - the flaw lets a user destroy audit data - while confidentiality (VC:N) and the subsequent-system metrics are untouched, so there is no data theft or code execution. The vector AV:N/AC:L/AT:N/PR:L/UI:N shows remote, low-complexity exploitation with no user interaction, but PR:L means the attacker must already hold a valid (even low-privileged) account, which meaningfully narrows the threat to insiders or attackers who have already gained a foothold. Publicly available exploit code exists (VulnCheck advisory plus a GitHub POC), lowering the skill barrier, but this CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat 'exploited' claims as unconfirmed. The practical danger is anti-forensics/log destruction (erasing all users' audit trails), which is typically a secondary action to hide other malicious activity rather than a primary breach objective. Net: a real priority to patch for anyone running JeecgBoot with multiple authenticated users, but its impact is availability/integrity of logs, not a direct system compromise. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has phished/obtained any valid account) sends a single crafted DELETE request to the SysLogController deleteBatch endpoint with the ids parameter set to the magic value 'allclear', wiping the entire sys_log table and erasing every user's audit trail. A working POC is publicly available (GitHub poc_log_delete_batch.py), so exploitation requires no custom tooling. This is most realistically used to destroy forensic evidence after other unauthorized activity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any authenticated user - including the lowest-privileged account - can send a DELETE request with the ids parameter set to the special value 'allclear' and wipe the entire sys_log audit table for every user. The result is silent, organization-wide destruction of audit trail evidence rather than data theft, code execution, or privilege escalation, which keeps the real-world impact bounded. Publicly available exploit code exists (a Python PoC script referenced by VulnCheck), and CISA KEV does not list this CVE as confirmed actively exploited (CISA KEV); the vulnerability is confirmed exploited only in the reported PoC sense, not in observed campaigns. CVSS scores of 7.1 (vendor v4.0 and our assessed v3.1) reflect high integrity impact on the log table with low availability impact and no confidentiality impact.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must begin with compensating controls. First, add an authorization guard to SysLogController.deleteBatch (reference lines 125-140 in the linked source) so the endpoint requires an administrative role rather than mere authentication, and explicitly reject or gate the 'allclear' sentinel value; until that code change is deployed, restrict the batch-delete endpoint at the perimeter or reverse proxy to admin networks only, accepting that this blocks legitimate log cleanup from other networks. Second, because the primary harm is loss of audit evidence, configure database permissions so the JeecgBoot application account has DELETE only where operationally required, and enable an append-only MySQL/PostgreSQL audit trail or binary-log retention policy - this prevents the wipe from being irreversible at the storage layer but will increase storage and log-management overhead. Third, use database triggers or periodic CDC export to ship sys_log rows to an immutable external SIEM or object store with retention locking, so a successful exploitation degrades to a gap in the primary table rather than total evidence loss; note this adds ETL complexity and latency. Fourth, rotate and monitor for suspicious DELETE traffic against the batch-delete route, and treat any request containing ids=allclear in web logs as a high-confidence indicator of compromise requiring incident response. Track the upstream project and the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-log-deletebatch for a fixed release; if upstream publishes a patched tag, upgrade as soon as it is validated in a staging environment, since the fix is expected to be a server-side access-control change rather than a schema migration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source Java/Spring Boot low-code development platform whose jeecg-system-biz module exposes REST controllers for administrative functions, including SysLogController at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysLogController.java. The vulnerable deleteBatch method (lines 125-140 of the referenced commit) accepts a DELETE request carrying a list of log ids and delegates directly to the persistence layer without verifying that the caller holds an administrative role, which is the textbook definition of CWE-862 (Missing Authorization). The method additionally supports a special sentinel value 'allclear' in place of a concrete id list, which the underlying logic interprets as a request to truncate the whole sys_log table instead of deleting selected rows - turning an ordinary bulk-delete convenience feature into a full-table wipe primitive. Because authentication (not authorization) is the only gate, the weakness class is an access-control bypass rather than an injection or memory-safety flaw, and exploitation requires only a valid low-privilege session and network reachability to the application (AV:N, AC:L, PR:L, UI:N per our assessed vector). The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms all JeecgBoot builds through the 3.9.5 tag are in scope, and no later fixed release is identified in the supplied references.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Remote, low-complexity, but requires a logged-in account so PR:L; destroying audit records is primarily an integrity loss (I:H) with minor availability impact (A:L) and no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.
Technical POC Analysis
CWE-862 (Missing Authorization).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JeecgBoot installations at or below version 3.9.5 contain a system-log controller that allows any account holder, regardless of privilege level, to erase the entire audit log table for the whole organization with a single request. The impact is permanent loss of audit evidence rather than data theft or system compromise, which directly undermines forensic investigations, insider-threat detection, and compliance obligations tied to log retention. Because no vendor patch is available and the affected component is widely deployed in internal business applications, leadership should treat this as a time-critical governance and evidence-integrity risk.
No vendor-released patch identified at time of analysis. Interim mitigations: block or filter DELETE requests containing ids=allclear at the WAF/reverse proxy; disable the sys_log batch-delete controller endpoint or its route mapping at the code level; restrict access to all log- and administration-related endpoints to a minimal set of named privileged accounts; replicate or stream audit logs to an immutable, off-host SIEM/syslog store so local deletion cannot eliminate evidence; apply database-level denies or triggers to prevent or record bulk DELETEs on audit tables; and monitor for the parameter pattern and for sudden reductions in sys_log row counts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB