CVE-2026-108675 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot installations, especially those with low-privileged user accounts accessing the affected functionality, should assess exposure and prioritize mitigation.

Why it matters

CVE-2026-108675 is a medium-severity vulnerability in JeecgBoot that allows low-privileged authenticated users to change announcement pin status. Defenders should verify exposure, especially in systems with low-privileged user access, and prioritize mitigation to prevent unauthorized changes and potential disruptions.

• Potential unauthorized changes to announcement pin status by low-privileged users.
• Possible disruption of system notice functionality.
• Need for verification of affected versions and scope of impact.
• Priority for implementing compensating controls and monitoring.

Technical summary

The vulnerability exists in the SysAnnouncementController editIzTop handler of JeecgBoot through 3.9.5. Low-privileged authenticated users can exploit this by sending POST or PUT requests with any announcement id to change the pin status of announcements, which are displayed at the top for all users. This could lead to unauthorized changes and potential disruptions in system notices shown to all users. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privileged users have access to the affected functionality.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privileged users have access to the affected functionality.

Recommended defensive actions

• Verify the version of JeecgBoot in use and assess if it is vulnerable (3.9.5 or earlier).
• Restrict access to the SysAnnouncementController editIzTop handler to only authorized users.
• Monitor for and limit unexpected changes to announcement pin status.
• Implement additional logging and monitoring for authentication and authorization events related to the SysAnnouncementController.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact requires further verification from official sources. Defenders should verify the existence of affected JeecgBoot installations, especially those with low-privileged user accounts accessing the SysAnnouncementController functionality. They should also check for any unauthorized changes to announcement pin status and assess the potential disruption of system notice functionality.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.