EUVD-2026-96563
GHSA-c9qp-mgqm-9x8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate record IDs via unguarded list endpoint
-
ExploitSubmit IDs to deleteBatch handler
-
ExecutionBypass missing authorization check
-
ImpactDelete arbitrary/queued message records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged account on the target JeecgBoot instance (version through 3.9.5) - the deleteBatch handler in SysMessageController performs no per-record authorization check (CWE-862). The attacker must also be able to reach the message list endpoint to harvest valid record IDs, which the description states is itself unguarded. No user interaction, no administrative privileges, and no special non-default configuration are required (AT:N, UI:N). The primary limiting factor is the need for valid low-privilege credentials (PR:L); impact is confined to deletion of message/notification records rather than broader system access. |
| Impact | This is a genuine but moderate-severity issue, not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low-privileged authentication, with limited integrity and availability impact and no confidentiality impact (VC:N/VI:L/VA:L), consistent with the base score of 5.3. Publicly available POC code (VulnCheck-reported, github-poc reference) lowers the barrier to exploitation, which is a meaningful risk amplifier. However, there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - the signals point to opportunistic or targeted abuse rather than mass campaigns. The authorization flaw is real and the POC confirms practicality, but the impact is bounded to deletion of message/notification records (integrity and availability of a messaging subsystem), not system compromise or data theft. Note a minor consistency point: VI:L and VA:L both apply because the attacker can destroy both existing and pending queued message records, but no code execution or privilege escalation path is indicated. EPSS data is missing from the input and should be checked to refine real-world exploitation probability. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user queries the unguarded SysMessage list endpoint to enumerate message record IDs, then submits those IDs to the deleteBatch handler, which fails to verify authorization. A public POC (poc_console_delete_routes.py) demonstrates this, allowing the attacker to delete arbitrary message push records, including pending queued notifications, from a standard low-privilege account over the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Deletion of arbitrary message records in JeecgBoot through 3.9.5 is possible by low-privileged authenticated users due to missing authorization in the SysMessageController deleteBatch handler. Attackers can obtain record IDs from an unguarded list endpoint and submit them to deleteBatch to remove pending queued messages, disrupting notification delivery. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the CVSS 4.0 score is 5.3, indicating moderate severity.
RemediationAI
No vendor-released patch identified at time of analysis. To mitigate, implement proper authorization checks on the SysMessageController deleteBatch endpoint, such as adding Spring Security's @PreAuthorize annotation with appropriate roles or permissions. Additionally, secure the message list endpoint to prevent unauthorized ID enumeration. As a temporary workaround, restrict access to the deleteBatch endpoint via network controls or a web application firewall (WAF) to allow only trusted administrators, though this may break legitimate message management features. Disabling the message deletion functionality entirely, if not essential, can eliminate the risk but may impact user workflows. Monitor for updates from the vendor and apply patches as soon as they become available. For further guidance, consult the VulnCheck advisory: https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-deletebatch-endpoint. Also note that a public exploit exists, so prioritize mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java-based low-code development platform built on Spring Boot. The vulnerability resides in the SysMessageController, specifically the deleteBatch handler (lines 104-109 of SysMessageController.java), which fails to perform any authorization check before deleting message records. This is a classic CWE-862: Missing Authorization, where the application does not verify that the authenticated user has the necessary permissions to delete the specified records. The related list endpoint also lacks authorization, allowing attackers to enumerate valid message IDs. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) indicates a network-accessible attack requiring low privileges, with limited impact to integrity and availability of message data only. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms that all versions of JeecgBoot are potentially affected, but the vendor has specified that the issue exists through version 3.9.5. No user interaction or special configuration is needed (UI:N, AT:N).
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable deleteBatch needs only a low-privileged account (PR:L), no user interaction; deleting records affects integrity and availability (I:L/A:L) with no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB