CVE-2026-108641

Received Received - Intake

JeecgBoot Insecure Direct Object Reference in Messages

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108641

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference in JeecgBoot through version 3.9.5. Authenticated users can read other users' in-application messages by exploiting the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record IDs from the unprotected /sys/sysAnnouncementSend/list endpoint and use them as the sendId parameter to retrieve message details such as titles, bodies, senders, and recipients.

Detection Guidance

To detect this vulnerability, check for unauthorized access to the /sys/sysAnnouncementSend/list endpoint and the getOne handler of SysAnnouncementSendController. Monitor logs for requests with sendId parameters that retrieve message details not belonging to the requesting user.

Impact Analysis

If you use JeecgBoot versions up to 3.9.5, an attacker with valid credentials could access private messages between other users. This could lead to unauthorized disclosure of sensitive information, including message content, sender and recipient details, and potentially other confidential data shared within the application.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to personal and sensitive information. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Exploiting this flaw may lead to non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Restrict access to the /sys/sysAnnouncementSend/list endpoint and SysAnnouncementSendController.getOne handler to authorized users only. Review logs for past unauthorized access and revoke any compromised credentials.

Hi! I’m here to help you understand CVE-2026-108641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70