CVE-2026-108641: JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated JeecgBoot user account and network access. No user interaction is required.
What information can be exposed through the vulnerable handler?
An attacker can retrieve other users' in-application message titles, bodies, sender details, and recipient details.
How can an organization check whether message records are accessible across users?
Using an authenticated test account, determine whether delivery record IDs can be obtained from /sys/sysAnnouncementSend/list and then supplied as the sendId parameter to /sys/sysAnnouncementSend/getOne. Access to records belonging to another user indicates exposure.