EUVD-2026-97053

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...

CVE-2026-108879

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the AiragBaseApiController component. This flaw allows authenticated users to access other users' AI chat variables by sending POST requests to the /airag/api/getChatVariable endpoin...