PT-2026-109884 · Jeecgboot · Jeecg-Boot

Yaqi Chao

·

CVE-2026-108623

·

Published

2026-10-10

·

Updated

2026-10-10

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys log table, erasing all users' audit trails.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-108623

Affected Products

Jeecg-Boot