EUVD-2026-96547

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108608

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The issue exists in the DELETE /airag/voice/deleteVoiceRecord endpoint, where authenticated users can delete the AI voice records of other users by providing an arbitrary userId parameter. Addition...