CVE-2026-108581: Missing Authorization

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

PT-2026-109876

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AiragExtDataController delete handler. Low-privileged authenticated users can delete AI evaluator or test-tracking records belonging to other users or tenants...

PT-2026-109927

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the AiragPromptsController. This issue allows any authenticated user to delete AI prompt templates. An attacker with low privileges can...

PT-2026-109934

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragPromptsController. This issue allows any authenticated user, including those with low privileges, to export all AI prompts from...

PT-2026-109937

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can download announcement attachments due to missing authorization in the SysAnnouncementController downLoadFiles handler. By providing a known announcement id, a...

PT-2026-109909

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SystemApiController within the GET '/sys/api/getDynamicDbSourceByCode' endpoint. The endpoint lacks Shiro permission or role annotations, allowing an authenticat...

PT-2026-109914

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryPageList handler of the OpenApiController. This allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can access the...

PT-2026-109912

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can retrieve role codes for any user due to missing authorization in the getRolesByUserId handler of the SystemApiController. Low-privileged attackers can provide arbitrary user...

PT-2026-109872

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AigcWordTemplateController delete handler. This issue allows any authenticated user, including those with low privileges, to permanently remove word templates fr...

PT-2026-109871

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AigcWordTemplateController edit handler. This issue allows authenticated users with low privileges to modify word templates by sending PUT or POST requests to th...

PT-2026-109873

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete word templates due to missing authorization in the deleteBatch handler of the AigcWordTemplateController. An attacker can permanently remove templates...

PT-2026-109878

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users with low privileges to create message templates. By calling the POST '/sys/message/sysMessageTemplate/add' endpoint, an attacker can insert arbitrar...

PT-2026-109881

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysPositionController. This issue allows any authenticated user, including those with low privileges, to delete organizational...

PT-2026-109875

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragExtDataController. This issue allows any authenticated user, including those with low privileges, to export AI evaluator data. ...

PT-2026-109887

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysMessageController. This issue allows authenticated users with low privileges to access any message push record by providing arbitrary...

PT-2026-109893

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartPermissionController. This issue allows any authenticated user to access department permission records. An attacker with low...

PT-2026-109901

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartRoleController. The issue stems from the absence of Shiro permission annotations, which are used to enforce access control. Thi...

PT-2026-109906

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysCategoryController that allows authenticated users to modify category dictionary nodes. By sending POST or PUT requests to the '/sys/category/edit' endpoint a...

PT-2026-109892

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartPermissionController delete handler. Low-privileged authenticated users can delete department permission bindings by obtaining row identifiers from an...

PT-2026-109924

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController deleteApply handler. This issue allows any authenticated user, including those with low privileges, to reject tenant administrator...