JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated… (CVE-2026-108623)

The vulnerability in JeecgBoot through version 3.9.5 is due to missing authorization checks in the SysLogController's deleteBatch handler. This allows any authenticated user to perform deletion operations on system audit logs without proper permission validation. Specifically, attackers can send a DELETE request with ids=allclear to wipe all entries in the sys_log table, effectively erasing audit trails that are critical for security monitoring and forensic analysis.

The vulnerability enables low-privileged authenticated users to delete all system audit logs, which compromises the integrity and availability of audit data. This can hinder incident detection and response by removing evidence of malicious or unauthorized activities. The confidentiality of data is not impacted, but the integrity of audit logs is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SysLogController deleteBatch handler to trusted users only and monitor for suspicious DELETE requests targeting the sys_log table.