JeecgBoot CVE-2026-108885

Requires a valid authenticated JeecgBoot account with at least low privileges (CVSS PR:L) that can reach the SysMessageController delete endpoint; no special product configuration, feature flag, or user interaction is needed, and the flaw is present in default deployments of JeecgBoot through 3.9.5 because the delete handler performs no per-record ownership/authorization check. The exploit itself is a single DELETE request with an arbitrary id value. The primary limiting factor is the authentication requirement - fully unauthenticated attackers cannot exploit it - so risk is highest on multi-tenant or broadly-provisioned instances and lower where low-privilege accounts are tightly restricted; impact is confined to deletion of sys_sms rows (no data disclosure or code execution).

This is a medium-severity (CVSS 4.0 base 5.3) missing-authorization flaw (CWE-862) whose real-world risk is genuinely moderate, not a high-CVSS-but-low-risk artifact nor a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L), which meaningfully constrains the attacker population to users who already have valid credentials on the JeecgBoot instance. Impact is deliberately limited: VC:N (no confidentiality loss) with only VI:L/VA:L, consistent with an attacker deleting notification rows rather than reading data or gaining code execution. A public POC exists (reported by VulnCheck), so exploitation is low-effort for anyone with access, but the vulnerability is NOT on the CISA KEV list, so there is no confirmed active exploitation. No EPSS score was provided in the input, so the empirical exploitation-probability signal is missing and cannot be weighed. SSVC-style reasoning: exploitation status is 'POC available' (not 'active'), the attack is likely automatable given a simple authenticated DELETE request, but technical impact is partial (data-deletion only, no takeover). Net: a legitimate but non-urgent patch priority - prioritize on internet-exposed or multi-tenant JeecgBoot instances where low-privileged accounts are broadly provisioned, and lower it where accounts are tightly controlled.

A low-privileged user who already holds a valid JeecgBoot account authenticates and issues a crafted DELETE request to the SysMessageController delete endpoint supplying arbitrary id values that they do not own. Because the handler performs no ownership or authorization check, the server deletes the targeted sys_sms rows, letting the attacker erase records of sent notifications (for example to destroy evidence of messages). A public POC (poc_c321_sys_message_delete.py) already demonstrates this, lowering the bar to exploitation.