CVE-2026-108868: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit the affected endpoint. Exploitation does not require user interaction.

Q: What does an attacker need to send unauthorized announcements?

The attacker needs valid authentication and access to POST /sys/api/sendBusTemplateAnnouncement. They can provide a templateCode, recipient in toUser, and a forged fromUser value.

Q: Which notification channels may be abused?

Unauthorized templated announcements can be delivered through WebSocket, DingTalk, WeCom, Feishu, and UniPush channels.

Q: How can I determine whether my deployment is affected?

Deployments running JeecgBoot through version 3.9.5 are affected if authenticated users can reach POST /sys/api/sendBusTemplateAnnouncement. Review requests to that endpoint for unexpected templateCode values, recipients, or sender identities that do not match the authenticated user.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit the affected endpoint. Exploitation does not require user interaction.

What does an attacker need to send unauthorized announcements?

The attacker needs valid authentication and access to POST /sys/api/sendBusTemplateAnnouncement. They can provide a templateCode, recipient in toUser, and a forged fromUser value.

Which notification channels may be abused?

Unauthorized templated announcements can be delivered through WebSocket, DingTalk, WeCom, Feishu, and UniPush channels.

How can I determine whether my deployment is affected?

Deployments running JeecgBoot through version 3.9.5 are affected if authenticated users can reach POST /sys/api/sendBusTemplateAnnouncement. Review requests to that endpoint for unexpected templateCode values, recipients, or sender identities that do not match the authenticated user.

CVE-2026-108868: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send unauthorized announcements?

Which notification channels may be abused?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send unauthorized announcements?

Which notification channels may be abused?

How can I determine whether my deployment is affected?