JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to… (CVE-2026-108622)

CVE-2026-108622 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5. The vulnerability exists in the SysLogController's delete handler, which does not properly restrict deletion of audit log entries to authorized users. Because the /sys/log/list endpoint is unguarded, attackers with low privileges can obtain log IDs and delete chosen sys_log records. This undermines audit integrity by allowing attackers to erase evidence of their actions.

The vulnerability allows low-privileged authenticated users to delete audit logs, which can hinder forensic investigations and incident response by removing traces of malicious activity. There is no direct confidentiality impact, but integrity and availability of audit logs are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /sys/log/list endpoint and the SysLogController delete handler to trusted users only, and monitor for suspicious deletion activity.