CVE-2026-108878 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and...