EUVD-2026-96619
GHSA-cmc8-rw33-2cqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any low-privileged account
-
ExploitCall POST /sys/api/sendTemplateAnnouncement
-
ExecutionForge sender, recipients, and template parameters
-
ImpactDeliver spoofed notifications as admin/system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold any valid authenticated JeecgBoot session (PR:L) - no administrative or elevated role is needed - and then issues a single POST request to /sys/api/sendTemplateAnnouncement with attacker-chosen sender, recipient, title, and template fields; the endpoint performs no authorization check, which is the core defect. No user interaction, no non-default configuration, and no admin credentials are required, but the need for a low-privileged account is the key limiting factor, confining realistic abuse to insiders or attackers who already hold valid credentials. Impact is bounded to sending forged/spoofed notifications (an integrity/social-engineering effect) in JeecgBoot versions through 3.9.5; there is no confidentiality or availability impact and no direct code execution. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores this 5.3 (medium), and the signals are internally consistent: network-reachable, low attack complexity, but requiring a low-privileged authenticated account (PR:L) and yielding only low integrity impact (VI:L) with no confidentiality or availability effect. This is a missing-authorization flaw (CWE-862) where the only barrier is holding any valid account, not administrative rights. Public exploit code exists (reported by VulnCheck, with a GitHub POC), which raises practical exploitability, but the CVE is NOT listed in CISA KEV and no EPSS exploitation-probability score was provided in the input, so widespread opportunistic exploitation cannot be confirmed from the data. Net assessment: this is a moderate, insider/phishing-oriented issue rather than a top-tier critical - the real-world danger is social engineering (messages appearing to come from admin/system accounts) rather than system compromise. It warrants prompt patching in multi-tenant or large-user-base deployments where account spoofing can seed phishing, but it is not a drop-everything RCE emergency. Missing data to note explicitly: no EPSS score and no KEV status were supplied, so exploitation prevalence is inferred only from POC availability. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has obtained any valid account) sends a POST request to /sys/api/sendTemplateAnnouncement, supplying a forged sender, arbitrary recipients, title, and template parameters. Because the endpoint lacks an authorization check, the platform delivers a notification appearing to originate from an admin or system account, enabling convincing internal phishing. A public proof-of-concept exploit for this endpoint is available, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated, low-privileged user send spoofed template announcements by POSTing to /sys/api/sendTemplateAnnouncement with attacker-chosen sender, recipient, title, and template parameters, so the resulting messages appear to come from admin or system accounts. Rated 5.3 (medium), the issue carries only low integrity impact with no confidentiality or availability effect and no path to code execution, and it requires the attacker to already hold a valid JeecgBoot session. Publicly available exploit code exists (VulnCheck-reported POC plus a GitHub PoC script), though there is no indication of confirmed active exploitation.
RemediationAI
No vendor-released patch or fixed version is identified in the available data for CVE-2026-108680, so affected deployments running JeecgBoot 3.9.5 or earlier should either upgrade as soon as JeecgBoot publishes a release that adds an authorization check to SystemApiController or apply compensating controls now. The most direct control is to add an explicit permission check to the sendTemplateAnnouncement handler (for example a permission/role annotation on the controller method) so that only administrators can invoke it; note that this is a code change and must be re-applied after each upstream upgrade. Where source modification is not possible, block or filter POST /sys/api/sendTemplateAnnouncement at the reverse proxy, API gateway, or WAF and return 403 - the trade-off is that legitimate template announcement delivery through that endpoint will stop working for all users. A narrower alternative is to restrict the entire /sys/api path to trusted internal networks or service accounts via network ACLs and gateway allowlists, which preserves automated integrations but breaks any remote or third-party callers. Because the endpoint only requires any valid low-privileged session, reduce the blast radius by auditing and disabling dormant or unnecessary user accounts, enforcing least privilege on roles, and alerting on notification traffic whose sender field references admin or system identities; also monitor for requests carrying template, recipient, or sender parameters that users would not normally control. Additional detection and remediation detail is documented in the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-sendtemplateannouncement) and the public PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.py, which can be used to verify whether an installation is still exploitable after mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot based low-code development platform whose administrative functionality is exposed under the /sys namespace, and the /sys/api path forms a programmatic API surface intended for internal or automation callers. The referenced upstream source (SystemApiController.java, lines 62-65) maps POST /sys/api/sendTemplateAnnouncement without any method- or route-level authorization annotation, so the request passes the authentication interceptor (JWT/Shiro-style session check) but is never checked against role or permission requirements - the classic CWE-862 missing authorization pattern, where a resource is reachable by any identity that can authenticate rather than by identities that are permitted to use it. Because the endpoint binds the sender, recipient list, title, and template fields directly from the request, a caller can impersonate administrative or system senders and push rendered notification content through the platform's template/message dispatch subsystem. The CPE identifier cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is version-wildcarded, consistent with the advisory statement that all releases up to and including 3.9.5 are affected; the operation is network-reachable, unauthenticated in the sense of needing no elevated privileges, and requires only a single request, which is why the CVSS 4.0 vector places it at AV:N/AC:L/AT:N with PR:L.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint with low complexity but requires any authenticated account (PR:L); impact is limited to forging notifications so I:L, with no confidentiality or availability effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB