EUVD-2026-96553

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...

EUVD-2026-96554

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

EUVD-2026-96555

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner...

CVE-2026-108615

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) in the AiragExtDataController delete handler. The flaw allows low-privileged authenticated users to perform unauthorized deletions by sending DELETE requests to the /airag/extData/delete endpoint. B...

CVE-2026-108616

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragExtDataController deleteBatch handler. This vulnerability allows any authenticated user to delete AI evaluator records by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint. The ...

CVE-2026-108614

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the AiragExtDataController exportXls handler. This flaw allows any authenticated user to access the /airag/extData/exportXls endpoint to export sensitive AI evaluator data , including evaluator definitions a...