CVE-2026-108877 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list...

CVE-2026-108877

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the AiragPromptsController component. The vulnerability allows any authenticated user to delete AI prompt templates by sending a DELETE request to /airag/prompts/delete. An attacker with low privileges can first...