PT-2026-109923

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove users from tenant product packs due to missing authorization. By sending a request to the 'PUT /sys/tenant/deleteTenantPackUser' endpoint, an attacker...

PT-2026-109662

Name of the Vulnerable Software and Affected Versions AstronRPA versions prior to 1.1.7 Description The robot-service lacks a tenant authorization check, allowing authenticated users to access shared variables belonging to other tenants. This is possible through the 'get-batch-shared-var' endpoin...

PT-2026-109885

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysMessageController. This issue allows authenticated users with low privileges to delete message push records, including those pendin...

CVE-2026-108671: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP...

PT-2026-109921

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to modify tenant settings. By calling the 'PUT /sys/tenant/updateApplyStatus' endpoint, low-privileged attackers can provide any tenant id to...

PT-2026-109876

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AiragExtDataController delete handler. Low-privileged authenticated users can delete AI evaluator or test-tracking records belonging to other users or tenants...

PT-2026-109941

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

PT-2026-109871

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AigcWordTemplateController edit handler. This issue allows authenticated users with low privileges to modify word templates by sending PUT or POST requests to th...

PT-2026-109874

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AiragAppController release handler. This issue allows any authenticated user to publish or unpublish AI applications belonging to other users. An attacker with l...

PT-2026-109909

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SystemApiController within the GET '/sys/api/getDynamicDbSourceByCode' endpoint. The endpoint lacks Shiro permission or role annotations, allowing an authenticat...

PT-2026-109908

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can create validation rules due to missing authorization in the importExcel handler of the SysCheckRuleController. By uploading a specially crafted Excel workbook...

PT-2026-109875

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragExtDataController. This issue allows any authenticated user, including those with low privileges, to export AI evaluator data. ...

PT-2026-109879

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message templates due to missing authorization. By accessing the unguarded list endpoint to obtain template IDs, an attacker can use the PUT...

CVE-2026-108650: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...

PT-2026-109903

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysAnnouncementSendController that allows authenticated users to modify message delivery records belonging to other users. An attacker can retrieve delivery...

PT-2026-109884

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysLogController. This issue allows any authenticated user, including those with low privileges, to delete system audit log entries. B...

PT-2026-109940

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the sendBusAnnouncement handler of the SystemApiController. This issue allows any authenticated user to send announcements without possessing the necessary...

PT-2026-109932

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists where the permission check in the queryById function is commented out in the source code. This allows any authenticated user to access the '/airag/app/queryById' endpoi...

CVE-2026-108165: Missing Authorization

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-108658: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records,...