JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates… (CVE-2026-108618)

CVE-2026-108618 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5. Low-privileged authenticated users can exploit this flaw by obtaining template IDs from an unprotected list endpoint and then sending PUT requests to the /sys/message/sysMessageTemplate/edit endpoint to modify system notification message templates. This allows attackers to inject arbitrary text or links into system notifications, potentially misleading other users. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthorized modification of system notification message templates by low-privileged authenticated users. This can lead to the injection of attacker-controlled content in notifications seen by other users, potentially facilitating social engineering or phishing attacks. There is no direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints and monitor for unauthorized modifications. Review user privileges to limit low-privileged users' ability to access message template management functions.