JeecgBoot through version 3.9.5 contains a missing authorization flaw that allows any authenticated user to invoke POST /sys/api/sendTemplateAnnouncement. The endpoint accepts forged sender, recipients, title and template parameters, enabling the attacker to deliver messages that appear to come from administrators or system accounts. This can be used for phishing, spam, or social engineering attacks without requiring elevated privileges.

JeecgBoot, version 3.9.5 and earlier, any deployment that has not applied the fix for the missing authorization on the /sys/api/sendTemplateAnnouncement endpoint.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. No EPSS score is available and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the application, but once authenticated the attacker can invoke the vulnerable API without additional permissions. The risk lies in the potential for impersonation and social engineering, which can lead to further compromise of the system or compromise of user trust.