JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated user…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 10, 2026 · NIST NVD

   Detected

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

2. Oct 14, 2026 · NIST NVD

   Updated

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

Sources

• CVE.orgVulnerability recordCVE-2026-108675

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-108675

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-108675

  JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or u

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com