CVE-2026-108675

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1086764.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows lo CVE-2026-1086776.5JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticate CVE-2026-1086784.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authen CVE-2026-1086794.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows CVE-2026-108689.0A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersCon CVE-2026-1086804.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by CVE-2026-1086814.3A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py CVE-2026-1086825.4A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the compon CVE-2026-1086834.3A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Me CVE-2026-1086846.3A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/CVE-2026-1086884.3Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privi CVE-2026-1086895.4Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI c