CVE-2026-108868: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit the affected endpoint. Exploitation does not require user interaction.
What does an attacker need to send unauthorized announcements?
The attacker needs valid authentication and access to POST /sys/api/sendBusTemplateAnnouncement. They can provide a templateCode, recipient in toUser, and a forged fromUser value.
Which notification channels may be abused?
Unauthorized templated announcements can be delivered through WebSocket, DingTalk, WeCom, Feishu, and UniPush channels.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 are affected if authenticated users can reach POST /sys/api/sendBusTemplateAnnouncement. Review requests to that endpoint for unexpected templateCode values, recipients, or sender identities that do not match the authenticated user.