EUVD-2026-96565
GHSA-9cr4-cm48-69pq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JeecgBoot account
-
DeliveryAuthenticate to application
-
ExploitEnumerate record ids on /sys/message/sysMessage/queryById
-
ExecutionRetrieve other users' message records
-
ImpactHarvest message content and receiver addresses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess a valid authenticated JeecgBoot session at any privilege level (PR:L) - the flaw is a missing ownership check on the queryById handler, so no special feature toggle or non-default configuration is needed beyond the message push module being in use. The attacker must know or brute-force/enumerate valid message record ids supplied to GET /sys/message/sysMessage/queryById. Limiting factors: a low-privileged account is a prerequisite (not fully unauthenticated), and impact is read-only disclosure of message content and receiver addresses with no write, integrity, or availability effect. |
| Impact | This is a moderate-risk information disclosure (IDOR / missing authorization, CWE-862) rather than a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L), and impact is limited to confidentiality of a single data type (VC:L; VI:N/VA:N - no integrity or availability impact), consistent with the 5.3 medium score. A public POC exists (reported by VulnCheck), so weaponization effort is near zero, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation. The signals are internally consistent: a low-barrier-but-low-impact read primitive with available exploit code. The main caveat is that PR:L means an attacker must first obtain any valid (even unprivileged) account, which limits purely external, unauthenticated mass exploitation; EPSS data is absent, so probability-of-exploitation cannot be quantified from the input. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged JeecgBoot account (or has registered/phished one) sends authenticated GET requests to /sys/message/sysMessage/queryById while incrementing or enumerating the record id parameter. Because the handler performs no ownership/authorization check, it returns message push records belonging to other users, disclosing message content and recipient addresses. A public Python POC (poc_record_query_by_id.py) already automates this enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot's SysMessageController queryById handler (all versions through 3.9.5) lets any authenticated user, at any privilege level, read the message push records of other accounts by supplying arbitrary record IDs to GET /sys/message/sysMessage/queryById, exposing message content and receiver addresses. The impact is read-only information disclosure - no integrity or availability effect - and exploitation requires a valid low-privileged session plus knowledge or enumeration of valid message record IDs, making this a moderate-risk IDOR rather than a pre-authentication compromise path (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3, PR:L, C:L). Publicly available exploit code exists (a Python PoC linked from the VulnCheck advisory), but there is no confirmation of active exploitation (CISA KEV).
RemediationAI
No vendor-released patch or fixed version is identified in the available data at the time of analysis, so the primary action is to add a server-side ownership/authorization check to the queryById handler in SysMessageController so that a message record is only returned when the requesting principal is its owner or holds an administrative role entitled to it; upstream the equivalent change would be inserting a permission or tenant/creator check before the record lookup (lines 117-121 of the referenced source file), which should be tracked against the JeecgBoot project for a future release beyond 3.9.5. Until a fix ships, deploy compensating controls: block or restrict GET /sys/message/sysMessage/queryById at the reverse proxy/WAF for all non-administrative roles, accepting that this may break legitimate message-viewing for ordinary users; if the message push module is not business-critical, disable or remove it from the deployed build, noting the trade-off of losing push-message history; enforce network-level restriction so the JeecgBoot API is not reachable from untrusted networks and require strong authentication for any account that can reach the system module; and monitor application logs for enumeration patterns of sequential message IDs against that endpoint, which provides detection but not prevention. Because the flaw is an IDOR, rotating or obfuscating record IDs is not a reliable mitigation. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-querybyid-endpoint) and the upstream source reference for confirmation of any subsequently released patched version before upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose system module exposes REST endpoints under /sys/**. SysMessageController is the Spring MVC controller responsible for the message push feature; the vulnerable handler queryById (source reference: jeecg-system-biz/.../message/controller/SysMessageController.java, lines 117-121) retrieves a message record directly from its ID without verifying that the requesting principal owns or is entitled to that record - the classic root cause class CWE-862 (Missing Authorization), manifesting as an insecure direct object reference (IDOR). The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms the identifier applies to the JeecgBoot product itself across the tracked version range up to and including 3.9.5. The supplied CVSS 4.0 vector is entirely network-reachable with low attack complexity and no user interaction, but PR:L confirms the attacker must already be authenticated, and the only impact metric set is VC:L (low confidentiality), with VI/VA and subsequent-system metrics all None - consistent with a pure read-only disclosure of message bodies and receiver addresses. The 4.0 vector carries an E:X (exploit maturity not defined) value, which should not be read as evidence of exploitation; the independent exploit-maturity signal is simply the public PoC referenced in the advisory.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N/AC:L) requiring any authenticated account (PR:L), no UI; impact is limited confidentiality disclosure only (C:L, I:N, A:N, scope unchanged).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB