JeecgBoot CVE-2026-108675

Requires a valid authenticated JeecgBoot account at any low privilege level (PR:L) - the flaw is the server's failure to enforce an authorization check on the SysAnnouncementController editIzTop handler, so any logged-in user can invoke it. Exploitation needs a POST or PUT request to the editIzTop endpoint containing an arbitrary announcement id; no user interaction and no special configuration are required. The limiting factors are that the attacker must first obtain or hold low-privileged credentials and that the impact is confined to toggling the top-pin (iz_top) status of announcements for all users - there is no data disclosure, code execution, or service disruption.

This is a genuine but low-severity access-control issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: a network-reachable endpoint reachable with low privileges and no user interaction, with impact confined to integrity (VI:L) and no confidentiality or availability effect (VC:N/VA:N). The CWE-862 classification (missing authorization) matches the description precisely - this is a broken-access-control flaw, not code execution or data theft. A public POC exists (reported by VulnCheck), which raises the practical likelihood of opportunistic abuse, but there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active real-world exploitation - POC availability and active exploitation are distinct signals. SSVC-style reasoning puts technical impact as partial/low (nuisance-level integrity change to a shared UI element) and, while the action is trivially automatable, the consequence is limited. Net: a real, confirmed vulnerability worth patching in a maintenance cycle, but its real-world risk is modest - a high-reachability, low-impact issue rather than a critical one. Note the 'Authentication Bypass' tag is imprecise: this is an authorization (access-control) flaw affecting an already-authenticated low-privileged user, not a bypass of authentication itself.

A user with any valid low-privileged JeecgBoot account authenticates normally, then sends a crafted POST or PUT request to the SysAnnouncementController editIzTop endpoint supplying an arbitrary announcement id. The server fails to check that the caller is authorized to manage announcements, so the attacker pins or unpins system notices displayed at the top for all users - enabling nuisance manipulation or social-engineering/phishing setups by surfacing attacker-chosen notices. A public proof-of-concept script for the POST variant is available, lowering the skill required to reproduce this.