JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged… (CVE-2026-108626)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the SysMessageController's queryById handler. Authenticated users with low privileges can exploit this by providing arbitrary record IDs to the GET /sys/message/sysMessage/queryById API endpoint, enabling them to read message push records of other users, including message content and receiver addresses. This is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, requiring low privileges, and no user interaction needed. The impact is limited to confidentiality loss of message data without integrity or availability impact.

An attacker with low-level authentication can disclose message content and receiver addresses of other users by exploiting the missing authorization check. This leads to a confidentiality breach of message push records. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious access patterns. Implement additional authorization checks on the queryById handler to ensure users can only access their own message records.