JeecgBoot EUVD-2026-96618

Requires a valid authenticated account of any privilege level (CVSS PR:L) that can reach the /sys/api/sendBusAnnouncement endpoint of SystemApiController; no admin role, special feature flag, or non-default configuration is needed because the flaw is the absence of the permission check that should gate announcement sending. Limiting factors: exploitation is impossible for fully unauthenticated outsiders (an account is required), and impact is confined to sending spoofed messages - there is no code execution, data disclosure, or service disruption, so damage depends on recipients acting on the phishing content.

This is a genuine but low-severity authorization flaw, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a valid low-privileged account (PR:L), with impact limited to integrity (VI:L) - no confidentiality or availability loss - which aligns with the CWE-862 missing-authorization root cause and the description of message spoofing. Publicly available POC code (VulnCheck, GitHub) lowers the exploitation bar and is corroborated by the vendor advisory, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation or widespread automated weaponization. The realistic risk is modest: the flaw does not grant code execution, data theft, or privilege escalation - its value is purely as a phishing/social-engineering enabler by letting ordinary users impersonate admin or system senders. Treat this as a moderate-priority fix (patch in normal cycle) rather than an emergency: the authenticated prerequisite and integrity-only impact keep real-world risk well below what the 'network, low-complexity, POC-available' framing might superficially suggest.

A low-privileged but authenticated JeecgBoot user (e.g., any registered account) sends a crafted POST to /sys/api/sendBusAnnouncement with a forged sender, recipient list, title, and body, bypassing the permission check that should restrict announcement broadcasting. The recipients receive what appears to be a legitimate system or administrator announcement, which the attacker uses for internal phishing - for example directing users to a credential-harvesting link or a malicious 'IT update.' A public POC script (poc_sys_api_credential_family.py) demonstrating this request already exists.