JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged… (CVE-2026-108624)

The vulnerability in JeecgBoot through version 3.9.5 involves a missing authorization check in the SysMessageController's deleteBatch handler. Low-privileged authenticated users can exploit this by first retrieving message record IDs from an unprotected list endpoint and then submitting these IDs to the deleteBatch handler to delete arbitrary message push records. This bypasses intended access controls and allows unauthorized deletion of messages, including pending queued messages.

The vulnerability allows low-privileged authenticated users to delete message records without proper authorization. This can disrupt message delivery by removing pending queued messages and compromise the integrity of message data. There is no impact on confidentiality, but integrity and availability of message records are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious deletion activity. Implement additional authorization checks on the deleteBatch handler if possible.