CVE-2026-108641 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a classic insecure direct object reference flaw within the application's announcement management module. This security defect is rooted in the SysAnnouncementSendController class, specifically affecting its getOne handler method which is responsible for retrieving individual message records based on an identifier provided by the client. The core technical failure lies in the absence of proper authorization checks that verify whether the authenticated user requesting the data has permission to access the specific record identified by the sendId parameter. Instead of validating ownership or administrative privileges before returning sensitive payload details, the application blindly trusts the input value and returns the corresponding database entry if it exists within the system's scope.
The exploitation path for this vulnerability is straightforward due to a secondary information disclosure issue in an unguarded endpoint. Attackers can access the /sys/sysAnnouncementSend/list endpoint without sufficient restrictions to enumerate valid delivery record identifiers, commonly referred to as sendId values. By iterating through these IDs or obtaining them from other sources such as browser history or network logs if previously accessed by legitimate users, an attacker can construct targeted requests against the vulnerable getOne handler. Supplying a discovered sendId allows the retrieval of comprehensive message metadata including titles, body content, sender identities, and recipient lists. This effectively bypasses any intended privacy controls that restrict message visibility to only authorized recipients or administrators.
From an operational impact perspective, this vulnerability compromises the confidentiality of internal communications within organizations utilizing JeecgBoot for enterprise resource planning or workflow management. Sensitive information such as HR announcements, financial directives, or strategic plans can be exfiltrated by any authenticated user with access to the application interface. The ability to map senders and recipients also facilitates social engineering attacks where attackers gain insights into organizational hierarchy and communication patterns. This level of detail aids in crafting more convincing phishing campaigns or insider threat scenarios, thereby extending the impact beyond simple data leakage to broader security posture degradation.
This flaw aligns with CWE-639, which categorizes issues related to authorization bypasses through direct object references where access control is not enforced on resource identifiers. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this vulnerability supports techniques associated with Collection and Exfiltration under T1005, as it enables unauthorized data collection via application APIs rather than network sniffing or file system access. It also relates to privilege escalation concepts in T1078 if lower-privileged users gain access to administrative-level communications.
Mitigation strategies must focus on implementing robust authorization checks at the controller level before any database queries are executed. Developers should ensure that every request to retrieve a specific record verifies that the current session's user identity matches the intended recipient or possesses elevated privileges required for cross-user data access. Input validation alone is insufficient; explicit ownership verification logic must be integrated into the getOne handler. Additionally, restricting access to enumeration endpoints like /sys/sysAnnouncementSend/list by requiring higher privilege levels will reduce the attack surface and prevent easy discovery of valid object identifiers. Regular security audits and static code analysis tools configured to detect insecure direct object references can help identify similar patterns in other parts of the application architecture before deployment.