EUVD-2026-21280Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 6.3 reflects medium severity with limited impact scope (unchanged system, low confidentiality and integrity loss). The CVSS vector PR:L indicates this requires an authenticated attacker, which restricts the threat landscape to users with some level of system access. The presence of publicly available exploit code and an EPSS severity designation elevates practical risk above the base CVSS, signaling that real-world exploitation is feasible. However, the authentication requirement and lack of confirmed active exploitation (no KEV status indicated) suggest this is a lower-priority issue compared to unauthenticated remote code execution vulnerabilities. Organizations should prioritize patching based on exposure (number of authenticated users with access to affected instances) rather than assuming critical urgency. The SSVC framework would classify this as having a technical impact of medium (privilege escalation within authenticated context) with high automatable potential given public exploits exist. |
| Exploit ScenarioDerived | An authenticated user with basic application access leverages publicly available exploit code targeting the SysAnnouncementController to craft a request that bypasses authorization checks, allowing them to view, modify, or delete announcements beyond their assigned role permissions. The low attack complexity and absence of user interaction requirements mean the attacker can automate this attack across multiple announcements or instances. The low authentication requirement suggests this could be chained with other vulnerabilities to escalate privileges within a larger compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Improper authorization in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to bypass access controls in the SysAnnouncementController component, potentially leading to unauthorized data modification and disclosure. The vulnerability has a CVSS score of 6.3 (medium severity) and carries an EPSS severity rating reflecting real-world exploitability; publicly available exploit code exists and the vendor has confirmed the issue with a patch expected in an upcoming release.
RemediationAI
Upgrade JeecgBoot to a version beyond 3.9.1 once the vendor releases a patched version; the vendor has confirmed the issue and committed to a fix in an upcoming release, though the specific version number is not yet disclosed in available data. Monitor the official JeecgBoot GitHub repository (https://github.com/jeecgboot/JeecgBoot/) and GitHub issue #9508 (https://github.com/jeecgboot/JeecgBoot/issues/9508) for release announcements. As an interim mitigation, restrict network access to JeecgBoot instances and limit authentication privileges for users who do not require announcement management capabilities, thereby reducing the attack surface to users with legitimate low-level access. Review audit logs for unauthorized announcement operations by authenticated users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the SysAnnouncementController component of JeecgBoot, a Java-based low-code development framework. The root cause is classified under CWE-285 (Improper Authorization), indicating that the component fails to properly enforce access control policies. The CVSS vector AV:N/AC:L/PR:L shows the vulnerability is remotely exploitable with low attack complexity and requires low-level privileges (authenticated user context), suggesting the flaw resides in privilege escalation or role-based access control (RBAC) enforcement logic within the announcement management functionality. The component likely fails to validate whether an authenticated user has legitimate authorization to perform specific operations on announcement resources.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB