JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged… (CVE-2026-108885)

CVE-2026-108885 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5 within the SysMessageController's delete handler. The flaw permits authenticated users with low privileges to issue DELETE requests specifying arbitrary message record IDs, thereby deleting any sys_sms database entries without proper ownership checks. This lack of authorization control could lead to unauthorized deletion of notification records.

The vulnerability allows unauthorized deletion of message records (sys_sms rows) by low-privileged authenticated users. This can result in loss of integrity of notification data and potential disruption of audit trails or notification history. There is no direct confidentiality impact, but integrity and availability of message records are affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SysMessageController delete functionality to trusted users only, or implement additional access controls to prevent unauthorized deletion of message records.