CVE-2026-108869 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw allows authenticated users with low privileges to execute administrative functions that should be restricted to system administrators or authorized personnel only. The core technical issue lies within the endpoint POST /sys/api/sendSysAnnouncement, which processes requests for sending system-wide announcements without adequately verifying whether the requesting user possesses the necessary permissions to perform this action. In a properly secured application architecture, such operations require strict role-based access control checks that validate not just authentication but also authorization levels before processing sensitive data modifications or communications.
By exploiting this missing authorization check, an attacker can manipulate several key parameters within the HTTP request payload. Specifically, the ability to supply arbitrary values for title, content, fromUser, and toUser fields enables significant abuse of the notification system. The fromUser field allows the attacker to impersonate legitimate administrators or other trusted entities when delivering messages, thereby increasing the credibility and potential impact of the malicious communication. This capability transforms a simple functional bug into a sophisticated social engineering vector, as recipients are likely to trust announcements appearing to originate from official sources within their organization's ecosystem.
The operational impact extends beyond mere unauthorized message delivery due to the integration with multiple enterprise communication channels supported by JeecgBoot. The vulnerability facilitates the dissemination of forged announcements via WebSocket connections, WeCom, DingTalk, and Feishu platforms. This multi-channel reach amplifies the potential damage significantly. Attackers can use these vectors to distribute phishing links, spread misinformation, or trigger panic among employees by broadcasting fake system alerts regarding security incidents, maintenance windows, or policy changes. The real-time nature of WebSocket notifications ensures immediate visibility to targeted users, while integration with popular workplace collaboration tools like WeCom and DingTalk allows the attack to bypass traditional email-based spam filters that might otherwise mitigate such threats.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Initial Access through Trusted Relationships or Command and Control via Application Layer Protocol if used for persistent backdoor communication. The ability to impersonate system users also touches upon Identity and Credential Abuse principles where trust in identity assertions is exploited without proper validation. Organizations relying on JeecgBoot for internal communications face heightened risks of data exfiltration, reputational damage, or operational disruption resulting from the loss of trust in official notification channels.
Mitigation strategies must prioritize immediate patching to version 3.9.6 or later where this authorization logic has been corrected. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to restrict access to the /sys/api/sendSysAnnouncement endpoint exclusively for administrative IP ranges or specific service accounts. Additionally, implementing strict input validation and sanitization on all user-supplied fields related to sender identity helps reduce the effectiveness of impersonation attempts even if exploitation occurs. Security teams should also audit existing logs for anomalous patterns in announcement creation timestamps and recipient lists that deviate from normal operational baselines indicative of this specific abuse vector.