CVE-2026-108675 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework, specifically affecting versions up through 3.9.5, and centers on a critical missing authorization vulnerability in the SysAnnouncementController component. The specific point of failure is the editIzTop handler method, which is responsible for managing the pinning status of system announcements displayed prominently at the top of user interfaces across the application. This architectural oversight allows any authenticated user with low-privileged access levels to manipulate this functionality without possessing the necessary administrative rights or elevated permissions typically required for such configuration changes. The vulnerability stems from a failure in the server-side logic to properly verify that the requesting entity holds the appropriate role-based access control privileges before executing state-changing operations on global system settings.
From a technical perspective, an attacker can exploit this weakness by crafting and sending HTTP POST or PUT requests containing arbitrary announcement identifiers to the vulnerable endpoint. By manipulating these parameters, the adversary gains the ability to pin or unpin specific notices for all users of the application, regardless of their individual permission sets. This lack of object-level and function-level access control means that a standard user can effectively hijack administrative functions related to system-wide communication channels. The exploitation does not require complex payload construction beyond valid JSON or form data containing the target announcement ID, making it highly accessible for automated scanning tools and opportunistic attackers who have obtained low-privileged credentials through phishing, credential stuffing, or other initial access vectors.
The operational impact of this vulnerability is significant due to its potential for social engineering and disruption of organizational communications. By pinning malicious announcements at the top of the interface, an attacker can create a persistent visual distraction that mimics legitimate system alerts or administrative notices. This capability facilitates phishing campaigns where users are tricked into clicking on fraudulent links embedded within these pinned messages under the false assumption that they originate from trusted administrators. Furthermore, unpinning critical official announcements can lead to information asymmetry and operational confusion, potentially delaying important updates regarding security patches, policy changes, or emergency procedures. The integrity of the communication channel is compromised, eroding trust in the platform's administrative controls and alerting mechanisms.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access control policies for a specific action. It also maps closely to MITRE ATT&CK technique T1078, specifically Valid Accounts, where attackers leverage legitimate credentials to perform actions outside their intended scope. Additionally, the ability to manipulate displayed content affects system integrity and can be categorized under influence tactics in social engineering contexts. To mitigate this risk, developers must implement strict role-based access control checks within the editIzTop handler, ensuring that only users with designated administrative roles can modify announcement pin statuses. Input validation should also be reinforced to verify that the requesting user has ownership or explicit permission for any specific announcement ID being modified, although in this case, the primary failure is at the function level rather than object level. Regular security audits and static code analysis focused on authorization logic are recommended to prevent similar oversights in future releases of the framework.