CVE-2026-108679: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

PT-2026-109919

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryTenantAuthInfo handler within the SysTenantController. This issue allows any authenticated user to access records belonging to other tenants. Low-privileged...

CVE-2026-108669: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

PT-2026-109905

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the delete handler of the SysCategoryController. This issue allows any authenticated user to delete category dictionary nodes. Attackers with low privileges can...

CVE-2026-108645: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move...

CVE-2026-108616: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner...

PT-2026-109931

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large...

PT-2026-109877

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the AiragExtDataController. This issue allows any authenticated user to delete AI evaluator and test-tracking records belonging to other...

PT-2026-109651

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.3.2 Description A missing authorization issue exists in the partner synchronization stream. Authenticated partners can access metadata for assets within the Locked Folder because synchronization queries fail to exclu...

PT-2026-109881

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysPositionController. This issue allows any authenticated user, including those with low privileges, to delete organizational...

CVE-2026-108620: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108632: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to...

PT-2026-109914

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryPageList handler of the OpenApiController. This allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can access the...

PT-2026-109916

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the QuartzJobController. This allows authenticated users with low privileges to access scheduled job records by sending a request to the...

PT-2026-109907

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the importExcel handler of the SysCategoryController. This issue allows any authenticated user, including those with low privileges, to upload specially crafted Exce...

PT-2026-109925

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can read any AI prompt template due to missing authorization in the queryById handler of the AiragPromptsController. An attacker can use the unguarded...

PT-2026-109917

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController within the GET '/sys/tenant/getTenantPackApplyUsers' endpoint. This issue allows any authenticated user to access tenant administrator...

PT-2026-109922

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to transfer tenant ownership. By sending a request to the POST '/sys/tenant/changeOwenUserTenant' endpoint, low-privileged attackers can use the...

CVE-2026-108665: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

CVE-2026-108659: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...