EUVD-2026-96546

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

EUVD-2026-96548

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CVE-2026-108609

JeecgBoot versions up to and including 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /airag/voice/listByUser endpoint. The root cause is an improper authorization check on the userId parameter, allowing authenticated users to access the AI voice generatio...