CVE-2026-108869

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108869

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

EUVD-2026-97043

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108869

The JeecgBoot framework (versions through 3.9.5 ) is vulnerable to a missing authorization flaw in the POST /sys/api/sendSysAnnouncement endpoint. This allows low-privileged authenticated users to send forged system announcements to any user. Attackers can provide arbitrary values for the title ,...

PT-2026-110191

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can send forged system announcements to any user via WebSocket, WeCom, DingTalk, and Feishu. This is possible by calling the POST '/sys/api/sendSysAnnouncement'...

CVE-2026-108869: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...