Executive brief
JeecgBoot, a low-code development platform, contains a security flaw in its system announcement management component. This vulnerability allows any logged-in user, regardless of their actual permissions, to create, modify, or delete system-wide announcements. An attacker could use this to broadcast phishing messages to all users or delete important corporate communications, potentially damaging organizational reputation and data integrity.
Technical details
The SysAnnouncementController in JeecgBoot (up to v3.9.1) fails to implement functional and horizontal access controls. Specifically, 12 management endpoints (including CRUD, Publish, and Revoke) lack Shiro permission annotations such as @RequiresPermissions or @RequiresRoles. While the system validates JWT tokens for authentication, it does not verify if the authenticated user has the authority to access these specific administrative routes or if they own the records being modified. A remote attacker with low-privileged credentials can exploit this to manipulate system-wide notifications via the /sys/annountCement/ route. The vendor has acknowledged the issue and plans a fix in a future release.
Affected products
- JeecgBoot JeecgBoot up to 3.9.1
Timeline
- 2026-03-31: disclosed: Vulnerability reported on GitHub issues
- 2026-04-10: advisory: CVE published and disclosed to the public