https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T08:24:07.635204+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-108671 fkie_cve-2026-108671 2026-10-11T08:24:07.786886+00:00

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.

 https://vulnerability.circl.lu/vuln/ghsa-p9cq-jf42-732x GHSA-p9cq-jf42-732x 2026-10-11T08:24:07.786983+00:00

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.