CVE-2026-108615: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

PT-2026-109876

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AiragExtDataController delete handler. Low-privileged authenticated users can delete AI evaluator or test-tracking records belonging to other users or tenants...