PT-2026-109901

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartRoleController. The issue stems from the absence of Shiro permission annotations, which are used to enforce access control. Thi...

PT-2026-109906

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysCategoryController that allows authenticated users to modify category dictionary nodes. By sending POST or PUT requests to the '/sys/category/edit' endpoint a...

PT-2026-109892

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartPermissionController delete handler. Low-privileged authenticated users can delete department permission bindings by obtaining row identifiers from an...

PT-2026-109924

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController deleteApply handler. This issue allows any authenticated user, including those with low privileges, to reject tenant administrator...

PT-2026-109898

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove members from user groups due to missing authorization. This is achieved by calling the 'DELETE /sys/user/deleteUserGroupBatch' endpoint. An attacker ca...

PT-2026-109895

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete department permission bindings due to missing authorization. An attacker can retrieve row identifiers from an unguarded list endpoint and provide them...

CVE-2026-108635: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars,...

CVE-2026-108633: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

CVE-2026-108668: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-b...

CVE-2026-108654: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108652: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108648: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...

CVE-2026-108646: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the...

CVE-2026-108680: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

CVE-2026-108677: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-108636: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...

CVE-2026-108625: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-108619: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108605: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

CVE-2026-108614: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...