← volver
CVE-2026-5999

JeecgBoot SysAnnouncementController improper authorization

CVSS 5.3 MEDIUMEPSS 0.2%CWE-266CWE-285
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
n/a · JeecgBoot
PoCs públicas encontradas — 1
cve_referencegithub.com/jeecgboot/JeecgBoot/issues/9508no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/jeecgboot/JeecgBoot/https://github.com/jeecgboot/JeecgBoot/issues/9508https://github.com/jeecgboot/JeecgBoot/issues/9508#issuecomment-4199090102https://vuldb.com/submit/793656https://vuldb.com/vuln/356553https://vuldb.com/vuln/356553/cti