https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T11:58:14.176967+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-108671 CVE-2026-108671 — JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById 2026-10-11T11:58:14.350780+00:00

Affected: JeecgBoot

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.