CVE-2026-5999

JeecgBoot SysAnnouncementController improper authorization

CVSS 5.3 MEDIUMEPSS 0.2%CWE-266 CWE-285

A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

n/a · JeecgBoot

public PoCs found — 1

cve_referencegithub.com/jeecgboot/JeecgBoot/issues/9508unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/jeecgboot/JeecgBoot/https://github.com/jeecgboot/JeecgBoot/issues/9508 https://github.com/jeecgboot/JeecgBoot/issues/9508#issuecomment-4199090102 https://vuldb.com/submit/793656 https://vuldb.com/vuln/356553 https://vuldb.com/vuln/356553/cti