Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-11T15:16:53.510Z",
  "pubdate": "2026-10-11T15:16:53.510Z",
  "executiveSummary": "JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability located within the system announcement module.\nThe vulnerability allows a low-privileged authenticated user to trigger the POST /sys/api/sendSysAnnouncement endpoint, which lacks appropriate server-side access control checks.\nThis security failure enables an attacker to craft and distribute arbitrary system announcements to any user or group within the platform.\nThe impact includes the ability to perform social engineering attacks, disseminate misinformation, or impersonate administrative personnel via integrated communication channels such as WebSocket, WeCom, DingTalk, and Feishu.\nThe exploitation requirement is minimal, necessitating only a low-privileged user account, which allows an attacker to bypass intended administrative workflow restrictions.\nThe risk implication is significant as it compromises the integrity of the internal communication system, potentially leading to unauthorized data exposure or organizational disruption.",
  "technicalDetails": "The vulnerability resides in the application's API layer, specifically at the endpoint POST /sys/api/sendSysAnnouncement. The root cause is a failure to implement robust authorization logic or role-based access control (RBAC) validations within the backend controller handling this request.\nIn a secure configuration, administrative endpoints designed for system-wide announcements should strictly enforce authorization checks to ensure only users with elevated administrative privileges can access them. However, in the affected versions, the application processes the POST request without verifying whether the requesting user possesses the necessary permissions to initiate such actions.\nThe exploitation flow is straightforward: 1) An attacker authenticates to the JeecgBoot instance as a standard user. 2) The attacker crafts a malicious HTTP POST request to /sys/api/sendSysAnnouncement. 3) The request body is populated with attacker-defined parameters including 'title', 'content', 'fromUser', and 'toUser'. 4) The application processes the request, bypassing security gates, and dispatches the forged announcement.\nThe impact is amplified by the platform's multi-channel notification architecture. Because the system announcement service is integrated with WebSocket, WeCom, DingTalk, and Feishu, the forged payload is propagated across these channels. This provides the attacker with a high-visibility platform to deliver payloads or instructions to specific targets or the entire user base.\nBy manipulating the 'toUser' parameter, the attacker can conduct targeted attacks against specific individuals or broadcast forged alerts to all users. By manipulating the 'fromUser' parameter, the attacker can perform impersonation, potentially misleading users into believing the message originated from a trusted administrator. This could be leveraged for phishing, distribution of malicious links, or spreading internal misinformation.\nThe absence of server-side validation for the request origin or sender identity makes this a critical flaw in internal communication security. Since the system treats these requests as legitimate administrative tasks, there is typically no secondary authorization or moderation process in place to prevent the distribution of the forged content once the initial endpoint is triggered."
}