CVE-2026-108680mediumCWE-862

CVE-2026-108680: fallo de gravedad media en JeecgBoot

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

Publicada el 10 oct 2026

30Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3

probabilidad de explotación

—

explotación observada

noninguna fuente lo reporta

1 exploit(s) público(s)

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

jeecgboot · JeecgBoot

PoCs públicas encontradas — 1

cve_referencegithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

CVEs relacionadas — JeecgBoot

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-58377HIGHJeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret KeysEPSS 0.4%CVE-2026-108679MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncementEPSS —CVE-2026-108678MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesEPSS —CVE-2026-108677HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByNameEPSS —CVE-2026-108676MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFilesEPSS —CVE-2026-108675MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTopEPSS —

Referencias

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.py https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L62-L65 https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-sendtemplateannouncement