EUVD-2026-96615
GHSA-hmx7-v3mc-j73j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate or obtain announcement id
-
ExecutionCall downLoadFiles handler with id
-
ImpactReceive ZIP of restricted attachments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated low-privileged JeecgBoot account (CVSS PR:L) and knowledge of a target announcement id, which the attacker supplies to the SysAnnouncementController downLoadFiles handler to retrieve a ZIP of attachments. The flaw is reachable on default configurations wherever the announcement feature is used and non-admin users exist. Limiting factors: exploitation is impossible for fully unauthenticated attackers (an account is mandatory), the attacker must know or enumerate valid announcement ids, and impact is confined to disclosure of announcement attachment contents - there is no write, modification, code execution, or availability effect. |
| Impact | This is a medium-severity information-disclosure flaw, not a critical priority. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 align with the description: exploitation is network-reachable and low-complexity, but requires an authenticated low-privileged account (PR:L), and impact is limited to confidentiality of announcement attachments (VC:L, with VI:N/VA:N - no integrity or availability impact). A public POC exists (published via the AnkesKasty repo, reported by VulnCheck), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC availability and lack of KEV together suggest opportunistic rather than mass exploitation risk. No signals conflict: the CVSS network vector is consistent with the HTTP-handler description, and the PR:L metric correctly reflects the 'low-privileged authenticated users' phrasing. The main caveat is that EPSS and KEV data are absent from the input, so widespread-exploitation probability cannot be quantified. Overall this is a genuine broken-access-control (IDOR-style) bug worth patching, but it is a high-CVSS-equivalent-pressure 'fix in normal cycle' item rather than an emergency, given authentication is required and only attachment confidentiality is at stake. |
| Exploit ScenarioDerived | A low-privileged but legitimate JeecgBoot user authenticates to the application and then calls the SysAnnouncementController downLoadFiles handler supplying a known or guessed announcement id, receiving a ZIP of attachments belonging to unreleased announcements or announcements addressed only to other users. A public POC (poc_announcement_file_download.py) automates this request, so exploitation requires only valid low-level credentials and minimal skill. Given AV:N/AC:L, the request can be sent remotely over the network with no special timing or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in the JeecgBoot SysAnnouncementController downLoadFiles handler lets any authenticated low-privileged user retrieve a ZIP of announcement attachments by supplying a valid announcement id, exposing files from unpublished announcements or announcements addressed only to other users. The flaw affects JeecgBoot through version 3.9.5 (CPE cpe:2.3:a:jeecgboot:jeecgboot:*), requires a valid non-admin account and knowledge or enumeration of an announcement id, and yields only confidentiality impact with no write, execution, or availability effect. Publicly available exploit code exists (a Python PoC script published on GitHub) but there is no confirmed active exploitation (not listed in CISA KEV), so this is a medium-severity information-disclosure issue rather than a critical priority.
RemediationAI
No vendor-released patch version is identified in the available intelligence at time of analysis, so the primary action is to track the JeecgBoot project for a release newer than 3.9.5 that adds an authorization check to the downLoadFiles handler and upgrade as soon as one is published. Until then, apply compensating controls: add a server-side authorization check (or a Spring Security / interceptor rule) that restricts the downLoadFiles handler to administrators or to users explicitly listed as recipients of the requested announcement id - this is the most complete mitigation but requires code changes and regression testing of the announcement feature; alternatively, block or restrict access to that handler at the reverse proxy for non-admin sessions, accepting that legitimate users will also lose the ability to download permitted attachments; if announcement attachments are not business-critical, disable the attachment feature entirely, at the cost of losing a collaboration function. Because exploitation is limited to authenticated low-privileged accounts, reducing the number of such accounts, auditing announcement-attachment download logs for anomalous or sequential id enumeration, and avoiding placement of sensitive material in announcement attachments (including drafts and targeted announcements) all reduce exposure. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-annountcement-downloadfiles) and the public PoC (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_announcement_file_download.py) to validate detection coverage, and note that the PoC's availability does not indicate confirmed active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module (jeecg-system-biz) exposes REST controllers for administrative functions, including SysAnnouncementController which manages internal announcements and their file attachments. The vulnerability is CWE-862 (Missing Authorization): the downLoadFiles handler at the referenced source lines (SysAnnouncementController.java lines 791-796 in commit e3b9dc0) accepts a caller-supplied announcement id and returns a ZIP archive of the associated attachments without verifying that the requesting principal is the intended recipient, an administrator, or otherwise entitled to that announcement. Because the check is absent rather than misconfigured, any principal that passes authentication - including a low-privileged user (CVSS PR:L) - can read attachments belonging to drafts/released-in-future announcements or announcements targeted at other users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree that the issue is network-reachable, low complexity, requires authentication, and produces only low confidentiality impact with no integrity or availability component. The CPE wildcard version range confirms all releases through 3.9.5 are affected.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable HTTP handler (AV:N/AC:L) exploitable by any authenticated low-privileged user (PR:L), disclosing only attachment data, so C:L with I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB