CVE-2026-108869: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privileged authenticated JeecgBoot user can exploit it. The attacker needs network access to the application and credentials for an account with low privileges; no user interaction is required.
Which notification channels can be abused?
Forged announcements can be delivered through WebSocket, WeCom, DingTalk, and Feishu. The attacker can choose arbitrary recipient values, allowing delivery to any users.
What can an attacker control in a forged announcement?
The request accepts attacker-supplied title, content, fromUser, and toUser values. This enables impersonation of the apparent sender and targeted or broad distribution of misleading messages.
How can defenders determine whether their deployment is affected?
Deployments of JeecgBoot through version 3.9.5 should assess access to POST /sys/api/sendSysAnnouncement. Review application and API logs for requests to that path made by low-privileged accounts, especially where the supplied fromUser does not match the authenticated requester.