JeecgBoot versions up to 3.9.5 contain a missing authorization flaw that allows users with low-level credentials to post arbitrary system announcements via the POST /sys/api/sendSysAnnouncement endpoint. Attackers can set any title, content, fromUser, and toUser values, letting them deliver forged announcements to any user through WebSocket, WeCom, DingTalk, and Feishu channels. This flaw is a CWE-862 authorization vulnerability and can lead to misinformation, phishing, or social engineering attacks within the affected application, potentially impacting confidentiality and integrity of user communications.

JeecgBoot version 3.9.5 and earlier. The affected product is JeecgBoot, maintained by jeecgboot. Any deployment of JeecgBoot up to and including version 3.9.5 is affected.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is unavailable, so the probability of exploitation cannot be quantified. This vulnerability is not listed in CISA KEV. Attackers would need to log in with low‑privilege accounts, implying that the threat is limited to authenticated users within the system, but the impact can be magnified if an attacker controls any account. Defenses are mitigated by patching or restricting the sendSysAnnouncement endpoint.