CVE-2026-108617 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's message management subsystem. Specifically, this is an insecure direct object reference or missing function level authorization flaw that affects the endpoint responsible for creating new system messages. The affected route, POST /sys/message/sysMessageTemplate/add, which handles the creation of notification templates for various communication channels including email, SMS, instant messaging, and internal system alerts, fails to verify whether the authenticated user possesses the necessary administrative privileges or specific role-based permissions required for this operation. In a properly secured application architecture, any action that modifies shared infrastructure components such as template libraries must be strictly gated behind high-privilege checks. However, in this instance, the backend logic accepts requests from users with minimal roles, effectively bypassing the intended security boundaries and allowing unauthorized modification of critical system configuration data.
From a technical perspective, the core issue lies in the absence of robust authorization middleware or explicit permission validation at the controller level for this specific API endpoint. When an authenticated user sends a POST request to add a new message template, the server processes the input payload without verifying if the session token corresponds to a role authorized to manage system templates. This allows attackers with low-privileged accounts to inject arbitrary content into the shared sys_sms_template database table. By controlling both the code identifier and the body of the notification, an attacker can craft malicious payloads that may be used for phishing campaigns, social engineering attacks, or further exploitation within the application ecosystem. The ability to define custom codes means these templates can potentially trigger specific automated workflows or notifications that users trust because they appear to originate from legitimate system processes.
The operational impact of this vulnerability is significant due to the central role message templates play in enterprise communication systems. Since these templates are used for critical alerts, password resets, and transactional notifications, their compromise undermines the integrity and authenticity of all outgoing communications. An attacker could replace a standard password reset template with one directing users to a malicious phishing site, thereby facilitating credential theft across the organization. Furthermore, because the vulnerability allows the insertion of arbitrary content, it can be leveraged for cross-site scripting if the templates are rendered without proper output encoding in subsequent views. This transforms a simple authorization bypass into a potential vector for persistent web attacks that affect all users receiving notifications generated by these compromised templates. The trust model of the application is fundamentally broken as low-privileged actors gain write access to shared resources, leading to data integrity violations and potential denial of service if malicious content disrupts notification services.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where a user can perform actions beyond their assigned role. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages legitimate but low-level credentials to achieve unauthorized administrative functions such as T1531, Account Access Removal or Modification in some contexts, though here it is more accurately described as Unauthorized Configuration Change. To mitigate this risk, immediate remediation should focus on implementing strict role-based access control checks at the API level for all endpoints that modify system configuration data. Developers must ensure that every write operation to shared libraries like sys_sms_template requires explicit verification of administrative privileges or specific permission flags within the authentication middleware. Additionally, adopting a principle of least privilege across the entire application stack and conducting regular security audits of authorization logic are essential steps to prevent similar bypasses in other modules.