CVE-2026-108626 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw resides within the SysMessageController component, targeting the queryById handler which is responsible for retrieving specific message push records from the system database. The core technical deficiency lies in the absence of robust authorization checks that validate whether the authenticated user initiating the request possesses the necessary permissions to access the requested resource identifier. In a properly secured application architecture, every API endpoint must enforce strict ownership verification or role-based access control before returning sensitive data. However, in this instance, the backend logic accepts an arbitrary record ID provided by the client and proceeds to fetch and return the corresponding database entry without verifying if that entity belongs to the current session user or if the user has administrative privileges required for cross-user data retrieval.
This architectural oversight allows low-privileged authenticated users to exploit the endpoint GET /sys/message/sysMessage/queryById by manipulating the input parameters. By supplying arbitrary record IDs, an attacker can bypass intended privacy boundaries and disclose confidential message content along with receiver addresses associated with other users in the system. The operational impact of this vulnerability is significant as it facilitates unauthorized data disclosure, potentially leading to further social engineering attacks or identity theft if personal contact information is exposed. Furthermore, because authentication is required but authorization is missing, the attack surface includes any valid user account on the platform, making exploitation relatively straightforward for malicious insiders or compromised accounts with minimal privileges.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability maps to T1078 Valid Accounts and potentially contributes to data exfiltration techniques where sensitive information is gathered from internal systems. The lack of object-level permission checks exemplifies a common pitfall in web application development where developers assume that authentication implies sufficient authorization for all actions within an authenticated session. To mitigate this risk, immediate remediation efforts should focus on implementing rigorous access control logic at the controller level or service layer. Developers must ensure that every data retrieval operation verifies the relationship between the requesting user and the target resource, ensuring users can only query records they own or are explicitly permitted to view. Additionally, adopting a principle of least privilege for API endpoints and conducting regular security audits using static application security testing tools can help identify similar authorization gaps before deployment in production environments.