JeecgBoot through version 3.9.5 contains a missing authorization flaw in the /sys/api/sendBusTemplateAnnouncement endpoint. An authenticated user can invoke this POST route to publish templated system announcements without any role or permission checks. The attacker supplies a template code, a target user identifier, and can forge the sender identity, enabling the dispatch of notifications via WebSocket, DingTalk, WeCom, Feishu, and UniPush channels. This allows a low‑privileged user to influence or misinform arbitrary users with minimal effort. The weakness is identified as CWE‑862.

All JeecgBoot releases up to and including 3.9.5 are impacted. The vulnerability resides in the SystemApiController component, which handles the sendBusTemplateAnnouncement API.

The CVSS score for this issue is 5.3, marking it as moderate risk. EPSS data for the vulnerability is not available, and it has not been listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. Exploitation requires the victim to be authenticated, but any authenticated user, even one with low privileges, can abuse the endpoint due to the lack of role checks. As a result, attackers with valid credentials can send arbitrary notifications to other users.