PT-2026-109884 · Jeecgboot · Jeecg-Boot

Yaqi Chao

·

CVE-2026-108623

·

Publicado

2026-10-10

·

Atualizado

2026-10-10

CVSS v3.1

7.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys log table, erasing all users' audit trails.

Exploit

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-108623

Produtos afetados

Jeecg-Boot