CVE-2026-108676

Received Received - Intake

Missing Authorization in JeecgBoot Allows File Download

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108676

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler. This flaw allows low-privileged authenticated users to download announcement attachments by supplying a known announcement ID. Attackers can access ZIP files of attachments from unreleased announcements or those intended for other users.

Detection Guidance

To detect this vulnerability, monitor for unauthorized access to announcement attachments via the SysAnnouncementController downLoadFiles endpoint. Check server logs for requests to /sys/announcement/downLoadFiles with known announcement IDs. Look for ZIP file downloads from low-privileged users accessing attachments outside their permissions.

Impact Analysis

An attacker could exploit this to access sensitive information in announcement attachments before they are officially released or intended for them. This may lead to data leaks, unauthorized access to confidential documents, or exposure of internal communications.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later to patch the missing authorization flaw. If an update is not possible, restrict access to the /sys/announcement/downLoadFiles endpoint by implementing proper authorization checks. Review server logs for signs of exploitation and revoke any unauthorized access.

Hi! I’m here to help you understand CVE-2026-108676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70