CVE-2026-108676: JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged authenticated JeecgBoot account and a known announcement ID. The affected handler can then be used to download a ZIP archive of that announcement's attachments.
What information could be exposed?
Attachments associated with unreleased announcements and announcements intended for other users may be disclosed. The provided data identifies confidentiality impact only; it does not indicate integrity or availability impact.
Are unauthenticated users affected?
The provided attack vector requires low privileges (PR:L), so authentication is required. The data does not indicate that unauthenticated access is possible.
How can an organization determine whether it is exposed?
Organizations using JeecgBoot through version 3.9.5 should review whether low-privileged accounts can request /sys/annountCement/downLoadFiles with announcement IDs for announcements they are not authorized to view. Successful retrieval of attachment ZIP files for such IDs indicates exposure.