EUVD-2026-96581
GHSA-mf94-5mc9-gxww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate delivery IDs via GET sysAnnouncementSend/list
-
ExecutionSubmit PUT sysAnnouncementSend/edit for others' records
-
ImpactOverwrite read flags/recipients to hide messages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account with access to the system announcement/message module; the attacker must be able to reach GET /sys/sysAnnouncementSend/list (to obtain other users' delivery record IDs) and PUT /sys/sysAnnouncementSend/edit (to modify them), which are standard endpoints in default deployments rather than a non-default feature. No additional configuration toggle is required and no end-user interaction is needed (UI:N). The principal limiting factor is the authentication requirement (PR:L): an attacker must already hold low-privileged credentials, so risk is concentrated in multi-tenant or untrusted-user deployments; impact is confined to integrity of message-delivery records (hiding/tampering with announcements) with no confidentiality or availability effect. |
| Impact | This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VI:L and C/A at N aligns well with the description: a network-reachable, low-complexity Insecure Direct Object Reference (CWE-639) requiring an authenticated low-privileged account, yielding limited integrity impact and no confidentiality or availability loss. The base score of 5.3 (Medium) is consistent with these metrics. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC), which raises operational relevance, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals and should not be conflated. The real-world risk is bounded by two factors working in opposite directions: the PR:L requirement means an attacker must already hold a valid account, limiting external opportunistic use, while the impact is narrow (manipulating message-delivery records to hide announcements) rather than code execution or data theft. Net assessment: a legitimate priority to patch for JeecgBoot operators with multi-tenant or untrusted authenticated users, but it does not rise to critical-emergency status given the authentication prerequisite and integrity-only, low impact. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user calls GET /sys/sysAnnouncementSend/list to harvest message-delivery record IDs belonging to other users, then issues PUT /sys/sysAnnouncementSend/edit requests referencing those IDs to overwrite read flags, recipient IDs, or linked announcements - effectively hiding or tampering with messages intended for other recipients. A public proof-of-concept exploit exists (GitHub and VulnCheck advisory), and the low attack complexity (AC:L) with no user interaction makes it straightforward to automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
JeecgBoot versions through 3.9.5 expose an authorization gap in SysAnnouncementSendController that lets any authenticated user tamper with other users' announcement delivery records, overwriting read flags, recipient identifiers, or the linked announcement so that messages are hidden from the intended recipients. Exploitation requires a valid low-privileged account and reachability to the standard GET /sys/sysAnnouncementSend/list and PUT /sys/sysAnnouncementSend/edit endpoints, which ship enabled in default deployments; no user interaction or special configuration is needed. Publicly available exploit code exists (a PoC script published in a public GitHub repository), and VulnCheck is credited with reporting it, but there is no evidence of confirmed active exploitation (not in CISA KEV). Impact is integrity-only against message-delivery data, with no confidentiality or availability effect, giving moderate severity (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 5.3, PR:L).
RemediationAI
No vendor-released patch identified at time of analysis for CVE-2026-108642, so teams must compensate until an upstream fix appears; use the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-put-sys-sysannouncementsend-edit) and the upstream source reference as the tracking points for a future release. The most direct mitigation is to modify SysAnnouncementSendController so the edit handler loads the delivery record and verifies it belongs to the authenticated principal (or that the principal holds an administrative role) before applying any update, rejecting mismatches with 403; trade-off is a small code change that must be reapplied on every upgrade until upstream ships an equivalent fix. If source changes are not feasible, add a gateway, WAF, or Shiro/Spring Security rule that blocks external access to /sys/sysAnnouncementSend/** or at minimum to the edit endpoint, permitting it only from trusted administrative networks; this breaks the legitimate announcement read-state flow for ordinary users if applied to the whole path, so scope it to PUT /sys/sysAnnouncementSend/edit where possible. Additional hardening includes restricting the platform's /sys/ API surface to trusted networks or VPN rather than the public internet, and auditing sys_announcement_send for rows whose recipient ID or read flag appear to have been altered unexpectedly, since tampering is silent and victims will simply stop seeing announcements. Note that upgrading without a vendor fix will reintroduce the weakness, so any local patch or filter must be tracked as custom code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-639 Authorization Bypass Through User-Controlled Key (IDOR). JeecgBoot is a Spring Boot/MyBatis-Plus low-code application platform whose system module exposes REST controllers under /sys/; SysAnnouncementSendController handles the sys_announcement_send join table that links announcements to recipients. The list endpoint returns delivery records, including the primary-key IDs of rows belonging to other users, and the edit endpoint (source lines 116-131 of SysAnnouncementSendController.java in the referenced commit) accepts a caller-supplied delivery ID and updates the row without verifying that the record belongs to the requesting principal or that the principal is authorized to alter it. Because the record key is attacker-controlled and the only check is authentication rather than ownership or role, a low-privileged authenticated user can rewrite the read flag, the recipient ID, or the linked announcement ID, effectively suppressing or redirecting announcements for arbitrary victims. The vulnerable pattern is exposed by default in the standard deployment, and the repository link in the references shows the exact code path, while the accompanying PoC script demonstrates the list-then-edit sequence against a live instance.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable IDOR requires a low-privileged authenticated account (PR:L) with no user interaction, yielding only limited integrity impact (I:L) and no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB