The vulnerability is a missing authorization check in JeecgBoot’s SystemApiController that allows any authenticated user to invoke the /sys/api/sendBusAnnouncement endpoint. Once reached, an attacker can craft the request payload to specify arbitrary sender, recipients, title, and content. The result is the delivery of spoofed announcements that appear to originate from an administrator or system account, enabling phishing or social engineering attacks that may compromise users or systems.

The affected product is JeecgBoot. The vulnerability exists in all releases up to and including version 3.9.5. No additional version granularity is provided in the official data.

The CVSS score of 5.3 indicates a medium severity, reflecting the need for authentication to exploit the flaw but the potential impact via spoofed administrative messages. EPSS data is unavailable, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a credentialed user or a user who can obtain valid credentials, meaning the exploit requires an authenticated session. The moderate CVSS and lack of known exploitation evidence suggest a moderate risk that could be elevated if attackers acquire legitimate user credentials.