JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users'… (CVE-2026-108641)

JeecgBoot through version 3.9.5 contains an insecure direct object reference vulnerability (CWE-639) that permits authenticated users to read other users' messages within the application. Attackers can enumerate delivery record IDs from the unprotected /sys/sysAnnouncementSend/list endpoint and supply these IDs as the sendId parameter to the getOne handler of SysAnnouncementSendController, thereby retrieving sensitive message information including titles, bodies, senders, and recipients. This vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality only.

Authenticated users can access other users' in-application messages, potentially exposing sensitive communication content such as message titles, bodies, senders, and recipients. The vulnerability does not impact integrity or availability. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /sys/sysAnnouncementSend/list endpoint and monitor authenticated user activities to limit unauthorized message access.