CVE-2026-108617 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot installations, especially those with low-privileged user access to the affected endpoint, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108617 is a medium-severity vulnerability in JeecgBoot that allows low-privileged users to create arbitrary message templates. Defenders should verify exposure, especially in systems with minimal role assignments, and prioritize remediation to prevent potential misuse of notification systems.

• Potential for unauthorized creation of notification templates
• Possible misuse of system, e-mail, SMS, and IM notifications
• Need for verification of affected versions and scope
• Priority for implementing compensating controls or monitoring

Technical summary

The vulnerability exists in the SysMessageTemplateController.java file, specifically in the add method. This method allows low-privileged authenticated users to create message templates without proper authorization checks. The vulnerability allows low-privileged authenticated users to create message templates by calling the POST /sys/message/sysMessageTemplate/add endpoint. As a result, attackers with minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS, and IM notifications. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected endpoint.

Recommended defensive actions

• Verify the version of JeecgBoot in use and check if it is vulnerable.
• Restrict access to the POST /sys/message/sysMessageTemplate/add endpoint for low-privileged users.
• Monitor for suspicious activity related to message template creation.
• Implement additional authorization checks for sensitive operations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the exact scope of affected systems and versions requires further verification from the official sources. Defenders should verify the version of JeecgBoot in use, check if it is vulnerable, and review the official advisory for affected scope, severity, and vendor guidance. The vulnerability exists in the SysMessageTemplateController.java file, specifically in the add method, which allows low-privileged authenticated users to create message templates without

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.