Is CVE-2026-108624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108624 being exploited in the wild.

How severe is CVE-2026-108624?

Medium severity, with a CVSS score of 5.4, published 10 October 2026.

Is there a fix for CVE-2026-108624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108624 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108624?

Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108624: JeecgBoot missing authorization in SysMessageController deleteBatch

CVE-2026-108624 · Severity: medium · CVSS 5.4 · Published 2026-10-10

JeecgBoot is a Java-based low-code rapid development platform used to build enterprise applications. The SysMessageController contains an authorization bypass that allows authenticated users with low privileges to delete any message records in the system, potentially disrupting message delivery and business communications.

Technologies: JeecgBoot. Vendors: Jeecg.

Quick answers

Is CVE-2026-108624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108624 being exploited in the wild.
How severe is CVE-2026-108624?: Medium severity, with a CVSS score of 5.4, published 10 October 2026.
Which products and versions are affected?: JeecgBoot through 3.9.5.
Is there a fix for CVE-2026-108624?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108624 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108624?: Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The deleteBatch endpoint in SysMessageController lacks proper authorization checks, allowing authenticated users to submit arbitrary message record IDs obtained from an unguarded list endpoint to delete any message push records. This is a broken access control vulnerability accessible via HTTP requests from an authenticated user context. The vulnerability allows deletion of pending queued messages without appropriate permission validation.

Affected products

Jeecg JeecgBoot through 3.9.5

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.