VULNERABILITY INTELLIGENCE

CVE-2026-108868

CVSS score5.3 MEDIUM
CISA KEVNot currently listed
Published2026-10-11
Last modified2026-10-11
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.

Weakness classification

  • CWE-862: Missing Authorization

Primary references