CVE-2026-108618mediumCWE-862

CVE-2026-108618: falha de média gravidade em JeecgBoot

JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint

Publicada em 10 out 2026

30Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.3

probabilidade de exploração

—

exploração observada

nãonenhuma fonte reporta

1 exploit(s) público(s)

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

jeecgboot · JeecgBoot

PoCs públicas encontradas — 1

cve_referencegithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c093_messagetemplate_edit.pynão verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

CVEs relacionadas — JeecgBoot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58377HIGHJeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret KeysEPSS 0.4%CVE-2026-108680MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncementEPSS —CVE-2026-108679MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncementEPSS —CVE-2026-108678MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesEPSS —CVE-2026-108677HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByNameEPSS —CVE-2026-108676MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFilesEPSS —

Referências

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c093_messagetemplate_edit.py https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L94-L98 https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-edit-endpoint