CVE-2026-108642: JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs an authenticated JeecgBoot account with the ability to access the announcement delivery list and submit requests to the edit endpoint. No user interaction is required.
What can an attacker change through the vulnerable endpoint?
The attacker can modify other users' message delivery records, including read flags, recipient IDs, and linked announcements. This can be used to hide messages from their intended recipients.
How can defenders determine whether exploitation may have occurred?
Review requests to PUT /sys/sysAnnouncementSend/edit for changes to delivery records made by users who do not own those records. Compare edited recipient IDs, read flags, and linked announcements against expected message-delivery history.