EUVD-2026-96614

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notic...

CVE-2026-108675

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the SysAnnouncementController editIzTop handler. This flaw allows low-privileged authenticated users to manipulate the pin status of system notices by sending POST or PUT requests with any announcement ID. C...