JeecgBoot CVE-2026-108868

Exploitation requires a valid authenticated session on JeecgBoot (CVSS PR:L); the attacker must be able to reach the POST /sys/api/sendBusTemplateAnnouncement endpoint and supply templateCode, toUser and a forged fromUser. No user interaction is needed and default configurations are affected because the endpoint lacks an authorization check. The primary limiting factor is that the attacker needs any low-privileged account - so risk is materially higher where self-registration or broad user access is enabled, and lower where accounts are tightly controlled; at least one notification channel (WebSocket, DingTalk, WeCom, Feishu or UniPush) must be configured for messages to be delivered. Impact is limited to spoofed/unauthorized notifications (integrity), not data disclosure or service disruption.

This is a genuine but moderate-priority issue - a medium-severity broken access control flaw, not a critical RCE. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requires an authenticated low-privileged account (PR:L) and yields only a Low integrity impact (VI:L) with no confidentiality or availability impact. Publicly available exploit code exists (github-poc, reported by VulnCheck), which raises practical exploitability, but there is NO EPSS score, NO SSVC decision data, and NO CISA KEV listing provided - so there is no evidence of active exploitation, and 'no public exploit identified' does not apply here because a POC is present. The limiting factor is authentication: because exploitation requires any valid logged-in account, this is most dangerous in multi-tenant or self-registration deployments where low-privileged accounts are easy to obtain. Net: real and POC-backed, but the authentication requirement and integrity-only, notification-spoofing impact keep it well below a drop-everything priority. No conflicting signals were detected between the CVSS vector and the description - both agree the attacker must be authenticated.

A low-privileged authenticated user (or an attacker who self-registers an account) sends a crafted POST request to /sys/api/sendBusTemplateAnnouncement specifying a templateCode, a target toUser, and a forged fromUser, causing the platform to deliver a spoofed system announcement to arbitrary users across WebSocket, DingTalk, WeCom, Feishu and UniPush. A public POC (poc_sys_api_send_bus_template_announcement.py) exists, lowering the bar to reproduce. Because the forged fromUser lets the message impersonate a trusted sender, the practical risk is social-engineering/phishing delivered through the application's own trusted notification channels.