JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any… (CVE-2026-108679)

CVE-2026-108679 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5 within the sendBusAnnouncement handler of the SystemApiController. The vulnerability permits any authenticated user to bypass permission checks and send announcements with arbitrary sender, recipient, title, and content values. This can be exploited by low-privileged attackers to deliver spoofed messages that appear to originate from administrators or system accounts.

The vulnerability allows unauthorized message sending with forged attributes, enabling attackers to conduct phishing or social engineering attacks by impersonating trusted system or admin communications. There is no direct confidentiality or availability impact reported, but the integrity of system announcements is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the sendBusAnnouncement API endpoint to trusted users only and monitor for suspicious announcement activity.