CVE-2026-108868 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's business logic layer. Specifically, this is classified as an insecure direct object reference or missing function level authorization issue where the system fails to verify that the authenticated user initiating the request has the legitimate authority to perform administrative actions on behalf of other users. The core technical flaw resides in the endpoint POST /sys/api/sendBusTemplateAnnouncement which processes requests containing templateCode, toUser, and fromUser parameters without adequately validating whether the session identity matches the intended sender or possesses elevated privileges required for such operations. This design oversight allows any authenticated user, regardless of their role or permission level within the application hierarchy, to manipulate these input fields to forge messages that appear to originate from system administrators or other high-privilege accounts.
From a technical perspective, the exploitation vector relies on the ability of an attacker to supply arbitrary values for the fromUser parameter while maintaining valid authentication credentials for a low-level account. By doing so, the application processes the request and dispatches notifications through various integrated communication channels including WebSocket, DingTalk, WeCom, Feishu, and UniPush without checking if the sender has permission to impersonate others or send bulk announcements. This lack of server-side validation on the source identity effectively bypasses role-based access control policies that are typically enforced for administrative functions like system-wide messaging. The vulnerability is particularly dangerous because it leverages trusted communication channels often used for critical alerts and official communications, thereby increasing the potential impact significantly compared to standard data exposure flaws.
The operational impact of this vulnerability extends beyond simple information disclosure or unauthorized modification of records. It enables low-privileged attackers to conduct sophisticated social engineering attacks by sending phishing messages that appear to come from legitimate administrative sources. Attackers can exploit trust in these communication channels to trick recipients into clicking malicious links, downloading malware, or revealing sensitive credentials. Furthermore, the ability to send templated announcements allows for widespread disruption of business operations if false emergency alerts are distributed across multiple platforms simultaneously. This capability undermines the integrity and reliability of internal communications within an organization, potentially leading to significant reputational damage and operational downtime as users become skeptical of legitimate administrative notifications due to the prevalence of forged messages.
This vulnerability aligns with CWE-269 which describes Improper Privilege Management where a user is able to perform actions that exceed their assigned privileges. Additionally, it maps to MITRE ATT&CK technique T1078 Valid Accounts as attackers leverage existing credentials and further exploit them through privilege escalation via logical flaws rather than technical exploits of authentication mechanisms. The use of multiple notification channels such as DingTalk and WeCom also relates to lateral movement or impact techniques where trusted services are abused for malicious purposes, similar to aspects of T1566 Phishing using legitimate platforms.
To mitigate this vulnerability, immediate remediation should focus on implementing strict server-side authorization checks within the sendBusTemplateAnnouncement endpoint. Developers must ensure that only users with specific administrative roles can invoke this function and enforce validation that prevents the fromUser parameter from being manipulated by end-users unless explicitly permitted under controlled conditions such as delegated task management which still requires audit trails. Input validation should also be strengthened to sanitize templateCode and other parameters against injection attacks while ensuring logical consistency between the authenticated session user and any specified sender identity. Regular security code reviews focusing on business logic flaws are essential, alongside implementing comprehensive logging of all announcement dispatches to facilitate detection of anomalous activity patterns indicative of exploitation attempts.