Medium severity · published Apr 10, 2026
CVE-2026-5999
JeecgBoot SysAnnouncementController improper authorization
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
JeecgBoot ·
3.9.0; 3.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5999
github.com
https://github.com/jeecgboot/JeecgBoot/
github.com
https://github.com/jeecgboot/JeecgBoot/issues/9508
github.com
https://github.com/jeecgboot/JeecgBoot/issues/9508#issuecomment-4199090102
vuldb.com
https://vuldb.com/submit/793656
vuldb.com
https://vuldb.com/vuln/356553
vuldb.com
https://vuldb.com/vuln/356553/cti
More from JeecgBoot
8.8
CVE-2026-2822
JeecgBoot Backend airag_app,1,create_by sql injection
8.8
CVE-2026-1746
JeecgBoot Online Report API loadDictItemByKeyword sql injection
8.8
CVE-2025-10707
JeecgBoot sendMsg improper authorization
8.8
CVE-2025-10318
JeecgBoot WebSocket Message sendWebSocketMsg improper authorization
8.1
CVE-2025-14909
JeecgBoot SysUserOnlineController.java SysUserOnlineController user session