Is CVE-2026-108626 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108626?

CVE-2026-108626 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-108626

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.