JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling… (CVE-2026-108680)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the API endpoint POST /sys/api/sendTemplateAnnouncement. This flaw permits any authenticated user, including low-privileged attackers, to send template notifications with forged sender, recipient, title, and template parameters, potentially impersonating admin or system accounts. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with network attack vector, low attack complexity, low privileges required, no user interaction, and limited impact on integrity but no impact on confidentiality or availability.

An attacker with valid authentication can send arbitrary template notifications that appear to originate from trusted admin or system accounts. This could be used for social engineering or phishing within the affected environment. There is no direct impact on confidentiality or availability, but the integrity of notification messages can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious notification activity.