JeecgBoot CVE-2026-108625

Requires a valid low-privileged authenticated JeecgBoot account (PR:L) and network access to the application's REST API; the specific prerequisite is the ability to call the PUT /sys/message/sysMessage/edit endpoint, which lacks an ownership/authorization check on the targeted sys_sms record id. No user interaction, non-default configuration, or elevated role is needed - any authenticated user can target any other user's record. The limiting factors are: (1) authentication is mandatory, so fully anonymous/unauthenticated exploitation is NOT possible, and (2) impact is confined to tampering with message-push records (integrity only), not data exfiltration or service disruption. Affected versions are JeecgBoot through 3.9.5.

This is a genuine-but-moderate access-control issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-862 (Missing Authorization) are internally consistent with the description: a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account and no user interaction. Impact is deliberately scoped to integrity only (VI:L; VC:N, VA:N) - an attacker can tamper with other users' sys_sms message-push records (title, content, receiver, send status) but cannot read confidential data or affect availability through this endpoint, which is why the score lands at 5.3 (Medium) rather than critical. A public POC exists (publicly available exploit code exists), lowering the barrier to opportunistic abuse, and the finding is credibly sourced to VulnCheck with a linked vendor source file. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation - the POC availability must not be conflated with in-the-wild use. Net: prioritize patching above purely theoretical high-CVSS findings because of the public POC and low attack complexity, but it is not a drop-everything issue given the integrity-only, authenticated, low-privilege profile. Note a terminology caveat: the input tags this as 'Authentication Bypass,' but it is actually a post-authentication authorization (IDOR) flaw - verify tagging before routing to teams.

A low-privileged but authenticated JeecgBoot user (any registered account) sends a crafted PUT /sys/message/sysMessage/edit request whose JSON body references a sys_sms record id belonging to another user. Because the endpoint performs no ownership check, the attacker overwrites that record's title, content, receiver address, and send status - enabling message spoofing or redirection of outbound notifications. A public Python POC (poc_c092_sysmessage_edit.py) automates this against default deployments, and the low attack complexity (AC:L) means no special timing or chaining is required.