CVE-2026-108884 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5, specifically targeting the SysMessageTemplateController component. This vulnerability is classified as a Broken Access Control issue, aligning with CWE-284 in the Common Weakness Enumeration taxonomy. The core technical deficiency lies in the absence of proper authorization checks on the HTTP DELETE endpoint responsible for removing message templates. While the application correctly implements authentication mechanisms to verify user identity, it fails to validate whether the authenticated user possesses the requisite administrative privileges or ownership rights over the specific resource being targeted. This oversight creates a critical gap where any valid session token can be leveraged to execute destructive actions on system-critical configuration data without restriction.
The operational impact of this vulnerability is significant due to the ease with which an attacker can exploit it. The attack chain begins with the enumeration phase, where low-privileged attackers utilize an unguarded list endpoint to retrieve a comprehensive inventory of existing message templates along with their unique identifiers. This lack of access control on the retrieval mechanism provides the necessary context for subsequent exploitation. Armed with these template IDs, the attacker proceeds to send crafted DELETE requests to the vulnerable handler. Because the server does not verify if the requesting user is authorized to delete the specific template identified by the ID, the request is processed successfully. This allows even users with minimal system privileges to remove templates that are essential for normal application operation.
The consequences of deleting shipped notification templates extend beyond simple data loss; they disrupt critical business workflows and communication channels within the organization. System notices, which often serve as alerts for security events or administrative updates, may cease to function if their underlying template is removed. Similarly, workflow reminders that depend on these templates will fail to trigger, potentially causing delays in approval processes, task assignments, or automated notifications. This disruption can lead to operational inefficiencies and a breakdown in internal communication protocols. From an offensive perspective, this vulnerability maps closely to the MITRE ATT&CK technique T1078, which involves Valid Accounts, as well as T1496, Remote File Deletion, highlighting how compromised or low-privileged credentials are leveraged to degrade system integrity and availability.
To mitigate this risk, immediate remediation efforts should focus on implementing robust authorization logic within the SysMessageTemplateController delete handler. Developers must ensure that every deletion request is validated against a centralized access control policy that checks for specific roles such as Administrator or Super User before proceeding with the database operation. Additionally, it is imperative to secure the list endpoint by enforcing similar access controls, preventing unauthorized users from enumerating sensitive resource identifiers. Implementing an Object-Level Access Control mechanism will ensure that users can only interact with resources they are explicitly permitted to manage. Regular security audits and static code analysis should be employed to detect such missing authorization flaws early in the development lifecycle, ensuring adherence to secure coding standards like OWASP ASVS Level 2 requirements for access control enforcement.