EUVD-2026-96545

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

CVE-2026-108606

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the AiOcrController deleteById handler. This allows any authenticated user to delete OCR records. An attacker with low privileges can first retrieve record IDs from the unguarded GET /airag/ocr/list endpoint and...