JeecgBoot CVE-2026-108641

Requires a valid authenticated JeecgBoot account of any privilege level (CVSS PR:L); exploitation then needs no special configuration because the /sys/sysAnnouncementSend/list endpoint is unguarded by default and the getOne handler performs no ownership check on the sendId parameter. The practical limiting factor is that the attacker must first obtain or register a low-privileged session - it is not exploitable fully unauthenticated - and impact is confined to reading other users' in-application announcement/messages (no write or availability impact). No user interaction, no non-default settings, and no specific platform are required beyond JeecgBoot at or below version 3.9.5.

This is a genuine but moderate-priority issue, best characterized as a confidentiality-only IDOR rather than a system-compromise flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score align well with the description: the attacker needs network access and valid low-privilege authentication (PR:L), no user interaction, and low attack complexity - consistent with an authenticated user enumerating another user's message records. Impact is limited to confidentiality (VC:L, VI:N, VA:N): message titles, bodies, senders, and recipients are disclosed, but nothing is modified and no availability is affected. Exploitation signals are mixed: a public POC exists (publicly available exploit code), which raises practical exploitability, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread active exploitation. The 'Authentication Bypass' tag is misleading - this is not an auth bypass; it requires an authenticated session (PR:L) and is an authorization/IDOR defect (CWE-639). The low-privilege authentication requirement and confidentiality-only impact keep real-world severity in the medium band despite the available exploit.

A low-privileged but authenticated JeecgBoot user queries the unguarded /sys/sysAnnouncementSend/list endpoint to harvest valid delivery-record IDs, then submits those IDs as the sendId parameter to the getOne handler of SysAnnouncementSendController to read messages belonging to other users. A public POC (poc_announcement_send_get_one.py) automates this enumeration, and because attack complexity is low (AC:L) and no user interaction is needed, the attack is reliable once any valid account is obtained.