EUVD-2026-96554

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

EUVD-2026-96555

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner...

CVE-2026-108616

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragExtDataController deleteBatch handler. This vulnerability allows any authenticated user to delete AI evaluator records by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint. The ...

CVE-2026-108615

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) in the AiragExtDataController delete handler. The flaw allows low-privileged authenticated users to perform unauthorized deletions by sending DELETE requests to the /airag/extData/delete endpoint. B...

CVE-2024-10762

CVE-2024-10762 affects lunary-ai/lunary prior to version 1.5.9. The /v1/evaluators/ endpoint does not enforce access control, permitting low-privilege users to issue DELETE requests that delete evaluator data, causing permanent data loss and potential operational disruption. Evidence from multipl...