JeecgBoot through version 3.9.5 contains a missing authorization check in the SysAnnouncementSendController. The flaw allows any authenticated user to update other users’ message delivery entries. Attackers can overwrite the read flag, change the recipient ID, or link a different announcement, effectively hiding messages from intended recipients or altering message delivery status. This creates a risk of data tampering and loss of message fidelity for users.

The vulnerability affects the JeecgBoot application, specifically all releases up to and including 3.9.5. No other versions are listed as affected in the available data.

The CVSS score of 5.3 indicates medium severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to be authenticated with a normal user account. An authenticated user can discover existing delivery IDs via the public list endpoint and then issue privileged edit requests to modify or conceal messages. Due to the lack of an existing exploit in the public domain, the immediate risk is moderate, but the lack of protection of sensitive message metadata makes it a valuable target for insider threats or compromised user accounts.