JeecgBoot CVE-2026-108869

Requires a valid authenticated session with at least low-privilege access to the JeecgBoot application (PR:L); the attacker then calls the unprotected POST /sys/api/sendSysAnnouncement endpoint, which performs no authorization check, and supplies arbitrary title, content, fromUser and toUser parameters. No user interaction or non-default configuration is needed beyond the announcement/notification channels being in use (WebSocket, WeCom, DingTalk, Feishu) for delivery to reach those transports. The principal limiting factor is the authentication requirement - a pre-existing low-privilege account is mandatory - so fully unauthenticated external attackers cannot trigger it directly.

This is a genuine but modest-severity access-control flaw (CWE-862, missing authorization) rather than a top-tier priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is internally consistent with the description: network-reachable, low attack complexity, but requiring low-privileged authentication (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability loss. Public exploit code exists (confirmed via the GitHub POC and VulnCheck advisory), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploit availability and active exploitation are distinct signals and must not be conflated. The realistic harm ceiling is forged system announcements (phishing/social-engineering via trusted internal channels), not data theft or RCE, which is why the integrity-only, low-impact rating is appropriate. Net: a legitimate fix-worthy issue because authenticated exploitation is trivial and tooling is public, but it is a low-to-medium real-world risk, not a critical emergency. Note the limiting factor - exploitation requires an existing authenticated (even low-privilege) account, which meaningfully reduces exposure versus a pre-auth bug.

A low-privileged but authenticated JeecgBoot user (or an attacker who has obtained any valid low-level credential) sends a crafted POST to /sys/api/sendSysAnnouncement with attacker-chosen title, content, fromUser and toUser fields. Because the endpoint lacks an authorization check, the forged announcement is delivered to arbitrary targeted users across WebSocket, WeCom, DingTalk and Feishu, enabling convincing internal phishing or social-engineering. Publicly available POC code (poc_sys_api_send_sys_announcement.py) automates this request.