CVE-2026-108669 JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

CVE-2026-108668 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-b...

CVE-2026-108668 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-b...

CVE-2026-108668

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler. This flaw allows any authenticated user to perform unauthorized actions by sending DELETE requests with specific prompt template IDs. Consequently, low-pr...

CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to cle...

CVE-2026-108667

The software JeecgBoot versions through 3.9.5 is affected by a missing authorization vulnerability (CWE-862). This flaw allows low-privileged authenticated users to restore deleted AI prompt templates by sending PUT requests to the /airag/prompts/revertRecycleBin endpoint. By providing specific t...

CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to cle...

CVE-2026-108665 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

CVE-2026-108666

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatc...

CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatc...

CVE-2026-108666

JeecgBoot (through version 3.9.5 ) is affected by a missing authorization vulnerability in the deleteBatch handler of the AiragPromptsController. This flaw allows any authenticated user to delete AI prompt templates. Specifically, a low-privileged attacker can retrieve prompt IDs from an unguarde...

CVE-2026-108665

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragPromptsController edit handler. This vulnerability allows any authenticated user to perform PUT or POST requests to the /airag/prompts/edit endpoint. By providing a specific template ID, a low-privileged a...

CVE-2026-108665 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatc...

CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatc...

CVE-2026-108664

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragPromptsController queryById handler. This vulnerability allows low-privileged authenticated users to access any AI prompt template by exploiting the unguarded /airag/prompts/list endpoint to enumerate IDs....

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...

CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to...

CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to...

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...