JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any… (CVE-2026-108884)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysMessageTemplateController's delete handler. Authenticated users can exploit this by first retrieving template IDs from an unguarded list endpoint and then deleting message templates without proper permission validation. This results in the deletion of shipped notification templates, which can cause failures in system notices and workflow reminders. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Exploitation allows low-privileged authenticated users to delete message templates, leading to disruption of system notices and workflow reminders. This can impair normal system operations that rely on these notifications, potentially causing workflow failures or missed alerts. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for unauthorized deletion attempts. Implement additional authorization checks on the delete handler if possible.