CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

CVE-2026-108618

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the sysMessageTemplate edit endpoint. Low-privileged authenticated users can exploit the PUT /sys/message/sysMessageTemplate/edit request to overwrite system notification titles and content. Attackers c...

CVE-2026-108619

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the sysMessageTemplate component. Specifically, the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint fails to properly restrict access, allowing low-privileged authenticated users to delete mes...

CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-108617

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) affecting the sysMessageTemplate/add endpoint. A low-privileged authenticated user can call POST /sys/message/sysMessageTemplate/add to insert arbitrary notification templates into the shared sys_sm...

CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner...

CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner...

CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

CVE-2026-108616

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragExtDataController deleteBatch handler. This vulnerability allows any authenticated user to delete AI evaluator records by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint. The ...

CVE-2026-108615

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) in the AiragExtDataController delete handler. The flaw allows low-privileged authenticated users to perform unauthorized deletions by sending DELETE requests to the /airag/extData/delete endpoint. B...

CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...

CVE-2026-108614

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the AiragExtDataController exportXls handler. This flaw allows any authenticated user to access the /airag/extData/exportXls endpoint to export sensitive AI evaluator data , including evaluator definitions a...

CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...

CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to...

CVE-2026-108613

Versions of JeecgBoot through 3.9.5 are affected by a missing authorization vulnerability within the AiragAppController release handler. This flaw allows any authenticated user to perform unauthorized actions on other users' AI applications. Specifically, a low-privileged attacker can send POST r...

CVE-2026-108612

The JeecgBoot application, versions through 3.9.5 , is affected by a missing authorization vulnerability in the AigcWordTemplateController 's deleteBatch handler. This flaw allows low-privileged authenticated users to perform unauthorized actions by sending a DELETE request to the /airag/word/del...

CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove a...