JeecgBoot up to version 3.9.5 has a missing authorization check in the SysAnnouncementController download endpoint, allowing an authenticated user with low privileges to request any known announcement id and retrieve a ZIP file containing attachments. The is therefore an access‑control failure (CWE‑862). It grants unauthorized disclosure of data that should be restricted to specific users or groups. The impact is a breach of confidentiality of attachment contents and potential exposure of sensitive information that was not intended for the attacker.

This issue affects the JeecgBoot software suite, specifically the SysAnnouncementController handling the /sys/annountCement/downLoadFiles endpoint. Users installing JeecgBoot version 3.9.5 or earlier are vulnerable. The vendor is jeecgboot:JeecgBoot and the product is the open‑source framework used for rapid application development.

The CVSS score of 5.3 indicates that the vulnerability is of medium severity. Because the attacker must be an authenticated user, the attack vector is limited to users who can log in to the system, but no elevated privileges are required. EPSS data is not available, so the exploitation probability cannot be quantified from that metric, and the vulnerability is not listed in the CISA KEV catalog. The impact is restricted to confidentiality loss rather than denial of service or privilege escalation. Nonetheless, low‑privileged users could access data that is meant to remain confidential, making the risk significant for sensitive environments.