JeecgBoot versions up to and including 3.9.5 contain an insecure direct object reference flaw. The flaw allows an authenticated attacker to supply a message identifier to the getOne handler and obtain the title, body, sender, and recipient of that message. The vulnerability stems from missing authorization checks for the sendId parameter, enabling an attacker to read messages belonging to other users.

JeecgBoot, all installations running versions 3.9.5 or earlier. Affected code is located in SysAnnouncementSendController – the list endpoint delivers identifiers that can be reused to retrieve message details via the getOne endpoint.

The CVSS score of 5.3 indicates a moderate severity. Because authentication is required, only users with valid credentials can exploit the flaw, limiting the attack surface to the legitimate user base. The EPSS score is unavailable, so the current prevalence of exploitation is unknown, and the vulnerability is not present in the CISA KEV catalogue. Nonetheless, the ability to read private messages is a medium risk to confidentiality for impacted users.