CVE-2026-108619 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw resides within the backend API endpoint responsible for batch deletion of system message templates, located at DELETE /sys/message/sysMessageTemplate/deleteBatch. The core technical issue stems from an insufficient verification of user privileges before executing destructive operations on sensitive configuration data. While the application correctly implements authentication to verify that a user is logged in, it fails to validate whether the authenticated session possesses the necessary administrative rights or specific permissions required to modify system-level configurations. This oversight allows any low-privileged authenticated user, such as standard end-users or non-administrative staff members, to interact with endpoints intended exclusively for system administrators.
The operational impact of this vulnerability is significant due to the central role that message templates play in enterprise application workflows. These templates are typically used to generate automated notifications, including workflow reminders, approval alerts, and transactional emails sent to users within the organization. By exploiting this missing authorization check, an attacker can supply a comma-separated list of template identifiers obtained from unguarded or publicly accessible listing endpoints. This capability enables the bulk deletion of all sys_sms_template rows in the database. The immediate consequence is the disruption of critical communication channels, leading to a denial of service for notification-dependent processes. Workflow engines that rely on these templates will fail to trigger subsequent steps, potentially halting business operations and causing data inconsistency if dependent states are not properly handled by fallback mechanisms.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials of a low-privileged user to perform unauthorized actions. It also reflects aspects of T1485 Data Destruction, where the attacker's intent is to impair availability by removing essential data components. The attack path typically involves enumerating available template IDs through less restricted endpoints and then constructing a malicious HTTP DELETE request with multiple identifiers in the payload. Because the backend does not cross-reference these requests against role-based access control policies or ownership checks for each specific resource, the system blindly executes the deletion command. This lack of object-level authorization is a common pattern in legacy or rapidly developed frameworks where security controls are applied at the route level rather than the data instance level.
Mitigation strategies must focus on implementing robust server-side validation and enforcing strict role-based access control. The primary fix involves modifying the deleteBatch endpoint to verify that the requesting user holds an administrative role or a specific permission flag designated for managing system configurations before processing any deletion requests. Additionally, developers should implement granular authorization checks that validate not only the user's general privileges but also their ownership or explicit rights over each individual template ID provided in the batch request. To further harden the application against enumeration attacks, access to listing endpoints containing sensitive configuration data like message templates should be restricted to authorized roles as well. Regular security audits and static code analysis focused on authorization logic are recommended to prevent similar oversights in other parts of the system architecture.