JeecgBoot EUVD-2026-96557

Requires a valid, low-privileged authenticated JeecgBoot account (PR:L) able to reach the PUT /sys/message/sysMessageTemplate/edit endpoint, which lacks an authorization check restricting template modification. Exploitation also relies on the message-template list endpoint being reachable without proper guarding so the attacker can enumerate valid template ids. No elevated privileges, no user interaction (UI:N), and no special non-default configuration are stated as required - any authenticated user of the platform appears sufficient. The limiting factor is the authentication requirement: fully external unauthenticated attackers cannot exploit this directly, and impact is confined to tampering with notification content delivered to other users (integrity only), not direct code execution, data disclosure, or denial of service.

This is a genuine but low-to-moderate priority issue, well below what a raw severity glance might suggest. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent: network-reachable, low complexity, but requiring low-privileged authentication (PR:L) and with impact limited strictly to integrity (VI:L, with VC:N and VA:N) - no confidentiality or availability loss. The description aligns cleanly with this vector: a low-privileged authenticated user abuses a missing authorization check (CWE-862) to overwrite message-template content that is then shown to other users. Exploitation status is 'publicly available exploit code exists' (VulnCheck-published PoC) but there is NO CISA KEV listing and no EPSS value was provided, so there is no evidence of active or widespread exploitation - PoC availability must not be conflated with in-the-wild use. SSVC-style reading: exploitation=public (PoC), automatable yes (single authenticated PUT request, template ids are enumerable from an unguarded list endpoint), technical impact=partial (content tampering / social-engineering vector, not direct RCE or data theft). The dominant residual risk is that the integrity flaw enables injection of attacker-controlled notification titles, content, and links into messages delivered to other users - effectively a phishing/social-engineering amplifier inside a trusted application - rather than direct system compromise. No signals are in hard conflict; the main caveat is the absence of EPSS/KEV data, so likelihood of mass exploitation cannot be quantified from the input.

A low-privileged authenticated JeecgBoot user queries the unguarded message-template list endpoint to enumerate template ids, then sends a crafted PUT /sys/message/sysMessageTemplate/edit request to overwrite a system notification template's title and body with attacker-supplied text or malicious links. Those tampered notifications are subsequently delivered to other, higher-trust users as legitimate system messages. A public Python PoC (poc_c093_messagetemplate_edit.py) demonstrating this exists.