CVE-2025-10318: Jeecg Boot Auth Bypass Vulnerability

CVE-2025-10318 Overview

CVE-2025-10318 is an improper authorization vulnerability in JeecgBoot versions up to 3.8.2. The flaw resides in the /api/system/sendWebSocketMsg endpoint within the WebSocket Message Handler component. Attackers can manipulate the userIds argument to bypass authorization controls and send WebSocket messages to arbitrary users. The vulnerability requires low-privileged authenticated access and can be triggered remotely over the network. Public exploit details are available, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond, and no official patch has been published at the time of writing. The weakness is classified under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Authenticated remote attackers can abuse the WebSocket message endpoint to send messages to users they should not be permitted to address, breaking authorization boundaries in JeecgBoot deployments.

Affected Products

JeecgBoot versions up to and including 3.8.2
Deployments exposing the /api/system/sendWebSocketMsg endpoint
JeecgBoot WebSocket Message Handler component

Discovery Timeline

2025-09-12 - CVE-2025-10318 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10318

Vulnerability Analysis

The vulnerability stems from missing authorization checks on the /api/system/sendWebSocketMsg endpoint exposed by the JeecgBoot WebSocket Message Handler. The endpoint accepts a userIds parameter that specifies the recipients of a WebSocket message. The handler trusts client-supplied recipient identifiers without verifying that the calling user has the privilege to address those targets. This permits a low-privileged authenticated attacker to push WebSocket payloads to arbitrary user sessions. The flaw maps to [CWE-266] Incorrect Privilege Assignment, where an actor gains the ability to perform actions reserved for higher-privileged roles. While the direct impact is limited to message delivery, attackers can use the channel for internal phishing, social engineering, or to deliver malicious links to other authenticated users. The EPSS score is 0.108% with a percentile of 28.5, reflecting limited but non-zero exploitation likelihood at this time.

Root Cause

The root cause is missing server-side authorization enforcement on the WebSocket message dispatcher. The application accepts the userIds parameter from the request body and forwards messages without validating that the authenticated session has permission to send to the listed recipients.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /api/system/sendWebSocketMsg with arbitrary user identifiers in the userIds argument. Because the handler does not validate caller-to-target authorization, the message is delivered to the targeted sessions. The attack is network-reachable and does not require user interaction.

No verified proof-of-concept code is available. See the VulDB advisory and the CNBlogs Security Post for additional technical details.

Detection Methods for CVE-2025-10318

Indicators of Compromise

Unexpected HTTP POST requests to /api/system/sendWebSocketMsg from low-privileged accounts
Requests where the userIds parameter contains identifiers belonging to administrators or unrelated tenants
WebSocket messages delivered to recipients that share no business relationship with the sending account

Detection Strategies

Inspect application access logs for invocations of the sendWebSocketMsg endpoint and correlate caller identity against the userIds parameter
Flag any session that issues requests to this endpoint at volumes inconsistent with normal user behavior
Alert on outbound WebSocket frames that originate from accounts without administrative or messaging roles

Monitoring Recommendations

Enable verbose audit logging on JeecgBoot system APIs and forward logs to a centralized analytics platform
Baseline normal usage of WebSocket administrative endpoints and alert on deviations
Monitor for repeated authorization failures or anomalous parameter values on /api/system/* routes

How to Mitigate CVE-2025-10318

Immediate Actions Required

Restrict network access to the JeecgBoot /api/system/sendWebSocketMsg endpoint using reverse proxy or web application firewall (WAF) rules
Limit the endpoint to administrative roles by enforcing authorization at an upstream gateway until a vendor patch is available
Audit existing user accounts and revoke unnecessary privileges that could allow access to the WebSocket message handler
Review historical logs for prior abuse of the userIds parameter

Patch Information

No official vendor patch has been published. The vendor did not respond to disclosure outreach according to the VulDB submission. Track the JeecgBoot project for future security releases and apply updates immediately when available.

Workarounds

Deploy a WAF rule that blocks requests to /api/system/sendWebSocketMsg originating from non-administrative sessions
Add a server-side authorization filter that compares the authenticated principal against the requested userIds before dispatching messages
Disable the WebSocket message broadcast feature if it is not required for business operations

bash

# Example NGINX rule restricting the vulnerable endpoint to an internal admin network
location = /api/system/sendWebSocketMsg {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://jeecgboot_upstream;
}