JeecgBoot CVE-2026-108884

Attacker must hold any valid authenticated JeecgBoot account, even the lowest privilege level (PR:L) - exploitation is not possible fully unauthenticated. Given such an account, no special product configuration is needed: the SysMessageTemplate list endpoint is unguarded (enabling ID enumeration) and the SysMessageTemplateController delete handler omits the authorization check, so the flaw is present in default deployments of JeecgBoot through 3.9.5. The limiting factors are the authentication requirement and the restricted impact - only deletion of message/notification templates, degrading availability of system notices and workflow reminders (VI:L/VA:L); there is no confidentiality impact and no code execution or privilege escalation.

This is a genuine but modest-severity integrity/availability issue rather than a top-priority emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 (Medium): network-reachable, low attack complexity, no user interaction, but requiring low-level authentication (PR:L) and yielding only low integrity and low availability impact with no confidentiality exposure. A public POC exists (VulnCheck advisory plus a GitHub exploit script), which raises practical risk, but the CVE is NOT on CISA KEV and no EPSS score was supplied, so there is no evidence of widespread active exploitation - treat POC availability and active exploitation as distinct signals. The signals are internally consistent: a missing-authorization flaw (CWE-862) that lets any authenticated user delete notification templates logically produces integrity/availability damage without data disclosure, matching VC:N/VI:L/VA:L. The main caveat is that exploitation is gated by needing a valid low-privileged account, which bounds blast radius to environments where untrusted or low-trust users already hold logins. Net: patch in normal cadence and prioritize where self-registration or large low-trust user bases exist; this is not a high-CVSS-but-no-real-risk false alarm, but neither is it a drop-everything critical.

A low-privileged authenticated user (e.g. a self-registered or basic account) calls the unguarded SysMessageTemplate list endpoint to enumerate template IDs, then invokes the delete handler, which performs no authorization check, to remove shipped notification templates. A publicly available POC script (poc_c322_sys_message_template_delete.py) automates this, and because the vector is AV:N/AC:L/UI:N the request succeeds remotely in a single low-complexity step, breaking system notices and workflow reminders.