CVE-2026-108623 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides in the SysLogController deleteBatch handler, which is designed to manage the deletion of system audit log entries. The core technical issue stems from an insufficient validation of user privileges before executing destructive database operations. While the application correctly requires authentication for general access, it fails to enforce role-based restrictions on this specific endpoint. Consequently, any authenticated user, regardless of their assigned privilege level or administrative status, can interact with this handler without encountering authorization barriers. This lack of vertical privilege escalation protection allows low-privileged accounts to perform actions that should be restricted exclusively to system administrators or security auditors.
The operational impact of this vulnerability is severe due to the nature of the data involved. System audit logs serve as a fundamental component for maintaining accountability, detecting malicious activity, and ensuring regulatory compliance in enterprise environments. By exploiting the missing authorization check, an attacker can send a DELETE request with the parameter ids set to allclear. This specific payload triggers the deletion of every record within the sys_log table rather than targeting individual entries. The result is the complete erasure of audit trails for all users on the system. This mass destruction of logs effectively blinds security monitoring tools and incident response teams, allowing subsequent malicious activities to go undetected. Furthermore, it hinders forensic investigations by removing historical evidence necessary to reconstruct attack timelines or identify compromised accounts.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1070 Indicator Removal on Host, specifically the sub-technique of clearing logs such as Windows Event Logs or Linux syslog files. Attackers leverage log deletion to cover their tracks and evade detection by security information and event management systems. The ability for any authenticated user to execute this action significantly lowers the barrier to entry for malicious insiders or external attackers who have obtained valid credentials through phishing, credential stuffing, or other initial access vectors. Once inside the application boundary, these actors can immediately disrupt observability without needing elevated privileges, making detection of the exploitation attempt itself difficult if log deletion is not monitored by an out-of-band system.
Mitigation strategies must focus on implementing strict role-based access control for administrative functions involving audit data. The SysLogController deleteBatch handler should be modified to verify that the requesting user possesses specific high-level roles, such as System Administrator or Security Auditor, before processing any bulk deletion requests. Additionally, input validation should restrict the ids parameter to accept only valid identifiers of log entries owned by or relevant to the current context, rather than accepting wildcard values like allclear that target the entire table. Implementing an immutable logging architecture where logs are written once and cannot be modified or deleted by application users provides a robust defense against this class of vulnerability. Regular security audits and penetration testing should also include checks for improper access control flaws in administrative endpoints to ensure that privilege boundaries are strictly enforced across all system components.