JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements… (CVE-2026-108868)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks on the POST /sys/api/sendBusTemplateAnnouncement endpoint. This allows any authenticated user, including those with low privileges, to send templated system announcements by specifying templateCode, toUser, and a forged fromUser. The notifications can be delivered through various channels such as WebSocket, DingTalk, WeCom, Feishu, and UniPush, potentially enabling unauthorized message dissemination.

The vulnerability does not allow confidentiality breaches or denial of service but permits integrity impact by enabling low-privileged users to send unauthorized notifications impersonating other users. This could lead to misinformation or social engineering risks within affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint and monitor for suspicious notification activity. Avoid granting unnecessary authenticated access to untrusted users.