CVE-2026-108679 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to /sys/api/sendBusAnnouncement with forged sender, recipients, title and content to deliver spoofed admin or system messages for phishing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the SystemApiController component. Specifically, the sendBusAnnouncement handler lacks proper authorization checks, allowing any authenticated user with low privileges to execute administrative functions intended for higher-privileged roles. This flaw is classified under CWE-269, which denotes Improper Privilege Control, and aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it involves the misuse of legitimate credentials to perform unauthorized actions. The absence of role-based access control validation on this specific endpoint creates a significant security gap that can be exploited by malicious actors who have obtained valid user credentials through phishing or other means.
Technically, the vulnerability stems from the server-side logic in the sendBusAnnouncement method not verifying whether the requesting user possesses the necessary administrative permissions before processing the request. An attacker can interact with this endpoint directly via HTTP POST requests to /sys/api/sendBusAnnouncement. By crafting a malicious payload that includes forged sender information, target recipients, titles, and content bodies, an attacker can bypass standard application workflows. The system processes these inputs as if they originated from authorized administrative accounts or system services, effectively allowing the injection of fake announcements into the platform's communication channels without triggering any security alerts or permission denials.
The operational impact of this vulnerability is severe due to its potential for social engineering and phishing attacks at scale. Since JeecgBoot is often used in enterprise environments where internal communications are trusted by employees, spoofed messages appearing as official system announcements can deceive users into clicking malicious links, downloading malware, or revealing sensitive credentials. The ability to forge the sender identity amplifies the trustworthiness of these fake notifications, making them particularly effective for credential harvesting campaigns. Furthermore, this capability could be used to disrupt business operations by sending misleading instructions or causing confusion among staff members regarding critical system updates or policy changes.
Mitigation strategies must focus on implementing robust authorization checks at both the application and framework levels. Developers should enforce strict role-based access control (RBAC) policies that validate user permissions before executing sensitive functions like sending bus announcements. It is essential to ensure that endpoints handling administrative tasks are protected by middleware or annotations that explicitly require elevated privileges, such as admin or super-user roles. Additionally, implementing input validation and sanitization can help prevent certain types of injection attacks, although the primary fix must address the authorization logic itself. Organizations running affected versions should immediately upgrade to a patched version where this access control flaw has been resolved. In the interim, network-level controls such as Web Application Firewalls (WAF) can be configured to monitor and block suspicious POST requests targeting this specific endpoint based on behavioral anomalies or known attack patterns associated with privilege escalation attempts.