CVE-2025-10707: Jeecg Boot Auth Bypass Vulnerability

CVE-2025-10707 Overview

CVE-2025-10707 is an improper authorization vulnerability in JeecgBoot through version 3.8.2. The flaw resides in the /message/sysMessageTemplate/sendMsg endpoint, where access control checks are insufficient. An authenticated remote attacker with low privileges can invoke the message-sending function outside of intended authorization boundaries. The weakness is tracked under CWE-266: Incorrect Privilege Assignment. Public exploit details have been disclosed, and the vendor did not respond to early disclosure attempts.

Critical Impact
Remote authenticated attackers can abuse the sendMsg function to perform actions reserved for higher-privileged users, affecting confidentiality, integrity, and availability of message-handling workflows.

Affected Products

JeecgBoot versions up to and including 3.8.2
Deployments exposing /message/sysMessageTemplate/sendMsg
Vendor: jeecg (jeecg:jeecg_boot)

Discovery Timeline

2025-09-19 - CVE-2025-10707 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10707

Vulnerability Analysis

JeecgBoot is a low-code enterprise development platform built on Spring Boot. The vulnerable handler is reachable at /message/sysMessageTemplate/sendMsg, which dispatches system messages built from stored templates. The endpoint fails to enforce authorization checks consistent with its sensitivity. As a result, a user holding only low-level credentials can invoke message dispatch operations intended for administrative roles.

Because messaging functions frequently touch internal users, templates, and notification channels, abuse can be used to deliver crafted content, trigger downstream automation, or enumerate template metadata. The issue is reachable over the network, requiring no user interaction beyond authenticating with any valid account.

Root Cause

The root cause is missing or incomplete authorization logic in the sendMsg handler. The function relies on authentication state without validating that the caller's role permits sending messages built from system templates. This maps to [CWE-266], where privileges are assigned or honored beyond what the role policy should allow.

Attack Vector

The attack is remote and authenticated. An attacker with any valid low-privilege session submits an HTTP request to /message/sysMessageTemplate/sendMsg, supplying template identifiers and recipient parameters. Without role enforcement, the server processes the request as if originating from an authorized operator. Technical analysis is referenced in the VulDB CTI Report #324995 and a public CNBlogs Security Analysis.

Detection Methods for CVE-2025-10707

Indicators of Compromise

Unexpected HTTP POST requests to /message/sysMessageTemplate/sendMsg originating from low-privilege user sessions.
Spikes in outbound system notifications, SMS, or email events not tied to administrator activity.
Application logs showing message dispatch actions paired with non-admin role identifiers.

Detection Strategies

Correlate authentication logs with message-sending events to flag accounts invoking admin endpoints they have never used before.
Deploy WAF or reverse proxy rules that inspect requests to the sendMsg path and verify caller role claims against an allowlist.
Review JeecgBoot audit tables for sys_message_template activity attributed to accounts outside the messaging administrator group.

Monitoring Recommendations

Enable verbose access logging for all /message/sysMessageTemplate/* routes and forward to a centralized SIEM.
Alert on anomalous request rates and on requests bearing low-privilege JWT or session tokens hitting administrative paths.
Track baseline message volume per role and trigger detections when low-privilege roles exceed expected thresholds.

How to Mitigate CVE-2025-10707

Immediate Actions Required

Restrict network access to the JeecgBoot management interface using firewall rules or an authenticated reverse proxy.
Disable or block the /message/sysMessageTemplate/sendMsg route at the gateway until an upstream patch is available.
Audit existing JeecgBoot accounts and revoke unnecessary low-privilege accounts that could be abused for authenticated exploitation.
Rotate credentials and session tokens for any accounts that may have been exposed.

Patch Information

The vendor did not respond to disclosure attempts at the time of publication, and no fixed version has been confirmed in the NVD record. Monitor the official JeecgBoot project for updates beyond version 3.8.2 and apply any subsequent releases that address authorization handling in the message template subsystem. Further details are tracked in VulDB #324995.

Workarounds

Add a servlet filter or Spring Security rule that enforces an administrator role check for /message/sysMessageTemplate/sendMsg.
Place the application behind an authenticating reverse proxy that validates role claims before forwarding requests to sensitive endpoints.
Temporarily remove or rename the sendMsg handler in deployments where messaging functionality is not required.

bash

# Example nginx rule to block the vulnerable endpoint at the edge
location = /message/sysMessageTemplate/sendMsg {
    return 403;
}