{"vulnerability": "cve-2026-1086", "sightings": [{"uuid": "51aa5350-a39f-45e8-aa84-7d3bdac74819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1086", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mghj2ol5xk2o", "content": "", "creation_timestamp": "2026-03-07T09:25:49.313057Z"}, {"uuid": "00544825-5571-441d-83f3-5557db5a6a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10861", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnhuhzxasw2b", "content": "CVE-2026-10861 - MISP post-login open redirect via pre_login_requested_url\nCVE ID : CVE-2026-10861\n \n Published : June 4, 2026, 2:16 p.m. | 16\u00a0minutes ago\n \n Description : An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value store...", "creation_timestamp": "2026-06-04T14:46:29.587323Z"}, {"uuid": "5c13212f-d263-4adf-9582-fd455e112889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10864", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/116692633027353872", "content": "https://nvd.nist.gov/vuln/detail/CVE-2026-10864\n\nA vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields. For the New Users widget, this could allow a non-site-admin user to obtain user e-mail addresses even when user e-mail disclosure was disabled by configuration. For the New Organisations widget, crafted field selection could similarly result in unintended organisation fields being included in the dashboard response. The issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields. Impact: An authenticated low-privileged user with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata, including user e-mail addresses depending on configuration.\n#misp", "creation_timestamp": "2026-06-04T15:51:15.801243Z"}, {"uuid": "90ce49a1-f7d0-4d40-911c-68679a3ff317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10868", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevata-vulnerabilita-in-misp-project-1", "content": "", "creation_timestamp": "2026-06-05T06:28:56.000000Z"}, {"uuid": "ce7c6991-2428-4d40-85c9-c0757df92b31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10862", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mntgm4zreg2r", "content": "CVE-2026-10862 - Accordions\nCVE ID : CVE-2026-10862\n \n Published : 9 juin 2026 02:16 | 29\u00a0minutes ago\n \n Description : The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due...", "creation_timestamp": "2026-06-09T05:10:11.535522Z"}, {"uuid": "5648af3a-4c99-43cf-8e7f-f94e69b91914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10862", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mnz3yrpvny2t", "content": "CVE-2026-10862 accordions (CVSS Score 6.4) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #accordions", "creation_timestamp": "2026-06-11T11:16:23.335090Z"}, {"uuid": "26aa9a66-dda9-4c90-ae0e-fd0e18cf34da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10865", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5kutobe2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-10865 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Cost Calculator Builder \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445\n\n\n\nhttps://kripta.biz/posts/12091F57-BB01-47AB-A12B-4021E209E2F7", "creation_timestamp": "2026-07-11T07:34:05.296200Z"}, {"uuid": "ad31c4ce-0e19-470c-aed6-082e6dc8713d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10865", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqeatdoff72k", "content": "CVE-2026-10865 - Cost Calculator Builder\nCVE ID : CVE-2026-10865\n \n Published : July 11, 2026, 5:35 a.m. | 1\u00a0hour, 48\u00a0minutes ago\n \n Description : The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ...", "creation_timestamp": "2026-07-11T08:32:29.809806Z"}, {"uuid": "598abd8b-528e-47ea-86d4-9c01f940ff82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108600", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418165421625375", "content": "CVE-2026-108600 open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108600https://hackmd.io/@haind/open-multi-agent-file-write-dangling-symlink-escapehttps://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/path-safety.ts#L104-L113https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/file-write.ts#L67https://github.com/open-multi-agent/open-multi-agenthttps://www.vulncheck.com/advisories/open-multi-agent-1.5.0-through-1.21.2-sandbox-escape-via-file-write-dangling-symlink#open-multi-agent#CVE_2026_108600#bot", "creation_timestamp": "2026-10-10T19:03:38.699333Z"}, {"uuid": "c18da1f0-5586-4007-b62f-bdd9c2980163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108602", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418639856743410", "content": "CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108602https://hackmd.io/@haind/helicone-webhook-dns-ssrfhttps://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85https://github.com/Helicone/heliconehttps://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution#Helicone #helicone#CVE_2026_108602#bot", "creation_timestamp": "2026-10-10T21:04:18.093101Z"}, {"uuid": "1e1fe16d-2c54-43fa-91f3-f2839880c75a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108603", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418642497781434", "content": "CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108603https://hackmd.io/@haind/BJnX7pIifxhttps://github.com/addsumtech/slides_maker/blob/3767cc346d63ef1646082c87f15fbf0be582b152/skills/slide-maker/scripts/generate_images_openai.py#L153-L156https://github.com/addsumtech/slides_maker/blob/3767cc346d63ef1646082c87f15fbf0be582b152/skills/slide-maker/scripts/generate_images_openai.py#L270-L285https://github.com/addsumtech/slides_makerhttps://www.vulncheck.com/advisories/slide-maker-through-5.8.0-path-traversal-via-generate-images-openai-py#addsumtech #slide-maker#CVE_2026_108603#bot", "creation_timestamp": "2026-10-10T21:04:58.312910Z"}, {"uuid": "075a97d5-f43c-44c0-bc7d-f074e4ee13c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108604", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418645141352613", "content": "CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108604https://hackmd.io/@haind/S1BofaIsMxhttps://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/ai_activity.rs#L357-L416https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/mcp/mod.rs#L1136-L1171https://github.com/TabularisDB/tabularishttps://www.vulncheck.com/advisories/tabularis-through-0.27.0-read-only-bypass-via-mcp-run-query-select-classification#TabularisDB #tabularis#CVE_2026_108604#bot", "creation_timestamp": "2026-10-10T21:05:38.691937Z"}, {"uuid": "a7135e3c-fd83-4cf0-96a5-5c0607f0bbb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108605", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418851481154079", "content": "CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108605https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_ocr_record_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/ocr/controller/AiOcrController.java#L56-L71https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-ocr-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108605#bot", "creation_timestamp": "2026-10-10T21:58:07.183370Z"}, {"uuid": "98bfc850-2599-4b73-9b79-497345665759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108606", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418854125872523", "content": "CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108606https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_ocr_record_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/ocr/controller/AiOcrController.java#L73-L93https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-ocr-deletebyid#jeecgboot #JeecgBoot#CVE_2026_108606#bot", "creation_timestamp": "2026-10-10T21:58:47.645061Z"}, {"uuid": "caa50c8c-dd25-4a8f-8a3e-f1af69396710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108607", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418856789500107", "content": "CVE-2026-108607 JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108607https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_video_record_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/video/controller/VideoGenerationController.java#L83-L90https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-deletevideorecord-userid-parameter#jeecgboot #JeecgBoot#CVE_2026_108607#bot", "creation_timestamp": "2026-10-10T21:59:28.262455Z"}, {"uuid": "f345c7c9-cf3b-4587-8668-06dce62b63ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108608", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418859435169812", "content": "CVE-2026-108608 JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108608https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_voice_record_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/voice/controller/VoiceController.java#L83-L90https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-deletevoicerecord-userid-parameter#jeecgboot #JeecgBoot#CVE_2026_108608#bot", "creation_timestamp": "2026-10-10T22:00:08.536241Z"}, {"uuid": "c20f3d89-bd8b-43bb-a335-daac9af0d4f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108609", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418862078120069", "content": "CVE-2026-108609 JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108609https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_voice_history_read.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/voice/controller/VoiceController.java#L74-L81https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-airag-voice-listbyuser-userid-parameter#jeecgboot #JeecgBoot#CVE_2026_108609#bot", "creation_timestamp": "2026-10-10T22:00:49.154609Z"}, {"uuid": "94a9de40-6346-4018-ac7c-a6266b207181", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108610", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418864715671192", "content": "CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108610https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L96-L107https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108610#bot", "creation_timestamp": "2026-10-10T22:01:29.128498Z"}, {"uuid": "dcba03a0-a325-4572-b536-3d56723b6578", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108611", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418867377608535", "content": "CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108611https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L115-L122https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-delete-endpoint#jeecgboot #JeecgBoot#CVE_2026_108611#bot", "creation_timestamp": "2026-10-10T22:02:09.711414Z"}, {"uuid": "6d7d3c1e-d1a5-4039-9cf9-993c0536c8f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108612", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418870020858057", "content": "CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108612https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L130-L137https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108612#bot", "creation_timestamp": "2026-10-10T22:02:50.111061Z"}, {"uuid": "5ade1b39-f1fe-41fc-b0ca-5fd64029c8e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108613", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418872666781575", "content": "CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108613https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_app_release.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/app/controller/AiragAppController.java#L135-L164https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-app-release-endpoint#jeecgboot #JeecgBoot#CVE_2026_108613#bot", "creation_timestamp": "2026-10-10T22:03:30.451914Z"}, {"uuid": "511e840a-76f2-4921-a518-e11b896dcef4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108614", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418875309964799", "content": "CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108614https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_prompts_export.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L190-L199https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-exportxls#jeecgboot #JeecgBoot#CVE_2026_108614#bot", "creation_timestamp": "2026-10-10T22:04:10.959657Z"}, {"uuid": "780ca975-624f-4f7c-aece-b86226851222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108615", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418877954925459", "content": "CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108615https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L124-L130https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-delete#jeecgboot #JeecgBoot#CVE_2026_108615#bot", "creation_timestamp": "2026-10-10T22:04:51.246625Z"}, {"uuid": "0f5c4815-7321-45f6-9d77-d9c8fe166562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108616", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418880597709663", "content": "CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108616https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L138-L144https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108616#bot", "creation_timestamp": "2026-10-10T22:05:31.478313Z"}, {"uuid": "090f9c60-600a-4d75-bc02-346100b20517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108617", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418883246154474", "content": "CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108617https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c089_messagetemplate_add.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L82-L86https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-add-endpoint#jeecgboot #JeecgBoot#CVE_2026_108617#bot", "creation_timestamp": "2026-10-10T22:06:11.900878Z"}, {"uuid": "30fd0bfb-483d-4c15-87ff-282fa86e37f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108618", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418885893981452", "content": "CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108618https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c093_messagetemplate_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L94-L98https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108618#bot", "creation_timestamp": "2026-10-10T22:06:52.226256Z"}, {"uuid": "af703c53-a8e7-459b-8c38-125e0c8a12bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108619", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418888538794062", "content": "CVE-2026-108619 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108619https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L118-L122https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-deletebatch-endpoint#jeecgboot #JeecgBoot#CVE_2026_108619#bot", "creation_timestamp": "2026-10-10T22:07:32.576408Z"}, {"uuid": "703454d6-65db-4afd-bd26-7e06217dde18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108620", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418891183976191", "content": "CVE-2026-108620 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all sys_position rows and orphan user-position assignments.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108620https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysPositionController.java#L183-L193https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-position-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108620#bot", "creation_timestamp": "2026-10-10T22:08:13.113019Z"}, {"uuid": "6c3cb86c-c815-4943-87a0-45afe8d0fec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108621", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418893822558944", "content": "CVE-2026-108621 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit to alter position names, codes, and ranks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108621https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c090_position_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysPositionController.java#L137-L152https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-position-edit#jeecgboot #JeecgBoot#CVE_2026_108621#bot", "creation_timestamp": "2026-10-10T22:08:53.391775Z"}, {"uuid": "21d6abf2-b366-4f50-add7-ada39c105315", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108622", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418896467865256", "content": "CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen sys_log records to erase traces of their actions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108622https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_log_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysLogController.java#L104-L118https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-log-delete-endpoint#jeecgboot #JeecgBoot#CVE_2026_108622#bot", "creation_timestamp": "2026-10-10T22:09:33.612739Z"}, {"uuid": "8d4f92db-ae9a-4856-bf7e-b849ec6be4fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108625", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418904387857107", "content": "CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108625https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c092_sysmessage_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageController.java#L79-L84https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108625#bot", "creation_timestamp": "2026-10-10T22:11:34.557508Z"}, {"uuid": "2b518676-a7b4-4ee3-b2a3-566d3a0f8989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108623", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418899108000476", "content": "CVE-2026-108623 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108623https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_log_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysLogController.java#L125-L140https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-log-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108623#bot", "creation_timestamp": "2026-10-10T22:10:13.950423Z"}, {"uuid": "92884133-ebde-471e-b403-25b74d8d66db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108624", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418901748461531", "content": "CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108624https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageController.java#L104-L109https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-deletebatch-endpoint#jeecgboot #JeecgBoot#CVE_2026_108624#bot", "creation_timestamp": "2026-10-10T22:10:54.253703Z"}, {"uuid": "d95f031e-44e5-45f5-b2f9-10c307156292", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108626", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419005345458689", "content": "CVE-2026-108626 JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108626https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_record_query_by_id.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageController.java#L117-L121https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-querybyid-endpoint#jeecgboot #JeecgBoot#CVE_2026_108626#bot", "creation_timestamp": "2026-10-10T22:37:14.966753Z"}, {"uuid": "c62b302e-1d9d-4af4-b124-e189d10d08e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108627", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419007991712775", "content": "CVE-2026-108627 JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108627https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_dept_role_policy_reads_and_save.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysRoleController.java#L449-L473https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-role-datarule-endpoint#jeecgboot #JeecgBoot#CVE_2026_108627#bot", "creation_timestamp": "2026-10-10T22:37:55.332203Z"}, {"uuid": "04ca015a-40a6-4695-a7ea-d6838c1b3ebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108628", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419010640524124", "content": "CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108628https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_dept_role_policy_reads_and_save.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L252-L271https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-savedeptrolepermission-endpoint#jeecgboot #JeecgBoot#CVE_2026_108628#bot", "creation_timestamp": "2026-10-10T22:38:35.899391Z"}, {"uuid": "98888f25-e86d-45ac-9ba8-9a455ae104b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108629", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419013277709271", "content": "CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108629https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_datarule.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L205-L227https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-datarule-endpoint#jeecgboot #JeecgBoot#CVE_2026_108629#bot", "creation_timestamp": "2026-10-10T22:39:16.031426Z"}, {"uuid": "d3f597e6-fe9b-4a86-bd0d-81ec98bcb493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108630", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419015923777765", "content": "CVE-2026-108630 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite depart_id, permission_id and data_rule_ids to alter which menus and data rules departments may delegate.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108630https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_edit_put.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L105-L110https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartpermission-edit#jeecgboot #JeecgBoot#CVE_2026_108630#bot", "creation_timestamp": "2026-10-10T22:39:56.470318Z"}, {"uuid": "336e3408-5a88-4883-a1ae-84ca24cc9c73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108631", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419018569115049", "content": "CVE-2026-108631 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108631https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L118-L123https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartpermission-delete#jeecgboot #JeecgBoot#CVE_2026_108631#bot", "creation_timestamp": "2026-10-10T22:40:42.025412Z"}, {"uuid": "ac177035-eb53-47a3-95b1-09542ff61890", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108678", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419142940106146", "content": "CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108678https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L472-L475https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-queryuserroles#jeecgboot #JeecgBoot#CVE_2026_108678#bot", "creation_timestamp": "2026-10-10T23:12:14.483408Z"}, {"uuid": "4ac82f0b-574e-43f4-a7af-d2d6f6302f6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108632", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419021215415268", "content": "CVE-2026-108632 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108632https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_query_by_id.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L144-L149https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-querybyid-endpoint#jeecgboot #JeecgBoot#CVE_2026_108632#bot", "creation_timestamp": "2026-10-10T22:41:21.180937Z"}, {"uuid": "9d804eee-914d-43a0-b7cb-b71d3a7a1f41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108633", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419023864367126", "content": "CVE-2026-108633 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants to any department for delegation to its roles.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108633https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_add.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L92-L97https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartpermission-add#jeecgboot #JeecgBoot#CVE_2026_108633#bot", "creation_timestamp": "2026-10-10T22:41:57.643513Z"}, {"uuid": "55109842-feee-46a1-92c7-fddc65e8958f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108634", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419026526794774", "content": "CVE-2026-108634 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108634https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L131-L136https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-deletebatch-endpoint#jeecgboot #JeecgBoot#CVE_2026_108634#bot", "creation_timestamp": "2026-10-10T22:42:38.246692Z"}, {"uuid": "9ad43bef-f789-4637-8659-1bea2c4198d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108635", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419029175575044", "content": "CVE-2026-108635 JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108635https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_org_scope_reads.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartController.java#L822-L829https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-getdepartmenthead-endpoint#jeecgboot #JeecgBoot#CVE_2026_108635#bot", "creation_timestamp": "2026-10-10T22:43:18.654936Z"}, {"uuid": "d639627a-cd95-446b-9ad9-7200bc926ac7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108636", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419031820882945", "content": "CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108636https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c091_sysdepart_appimport_xlsx.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartController.java#L682-L717https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepart-appimportexcel#jeecgboot #JeecgBoot#CVE_2026_108636#bot", "creation_timestamp": "2026-10-10T22:43:59.012714Z"}, {"uuid": "8af21a1a-d0db-4521-848f-354d5111fb32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108637", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419034471521522", "content": "CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108637https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L851-L866https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-deleteusergroupbatch-endpoint#jeecgboot #JeecgBoot#CVE_2026_108637#bot", "creation_timestamp": "2026-10-10T22:44:39.426031Z"}, {"uuid": "b921cae8-e9fb-4c87-bbac-523890ebb223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108638", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419037112062008", "content": "CVE-2026-108638 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108638https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_user_group_member_removal.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java#L829-L844https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-user-deletegroupuser#jeecgboot #JeecgBoot#CVE_2026_108638#bot", "creation_timestamp": "2026-10-10T22:45:19.694413Z"}, {"uuid": "d60c2492-0208-431d-b819-43190cb8d6cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108639", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419039755756907", "content": "CVE-2026-108639 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id} JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108639https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_dict_physic_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDictController.java#L742-L751https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-dict-deletephysic-id#jeecgboot #JeecgBoot#CVE_2026_108639#bot", "creation_timestamp": "2026-10-10T22:46:00.136265Z"}, {"uuid": "c50c5a09-73d8-4e6d-96e9-cfbde2afa673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108640", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419042399739018", "content": "CVE-2026-108640 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108640https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_org_scope_reads.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartRoleController.java#L170-L175https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-sysdepartrole-querybyid#jeecgboot #JeecgBoot#CVE_2026_108640#bot", "creation_timestamp": "2026-10-10T22:46:40.338989Z"}, {"uuid": "b84cf839-8669-4960-8451-c00899c83b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108641", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419045043752374", "content": "CVE-2026-108641 JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108641https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_announcement_send_get_one.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysAnnouncementSendController.java#L272-L276https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-sys-sysannouncementsend-getone#jeecgboot #JeecgBoot#CVE_2026_108641#bot", "creation_timestamp": "2026-10-10T22:47:20.805015Z"}, {"uuid": "17c6bbb6-b1c4-4193-81c8-d058f5189343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108642", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419047687018803", "content": "CVE-2026-108642 JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108642https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c094_announcementsend_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysAnnouncementSendController.java#L116-L131https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-put-sys-sysannouncementsend-edit#jeecgboot #JeecgBoot#CVE_2026_108642#bot", "creation_timestamp": "2026-10-10T22:48:01.083468Z"}, {"uuid": "7e9436dd-fa53-4f18-a38d-a05b0eb8cac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108643", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419050332941025", "content": "CVE-2026-108643 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108643https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysCategoryController.java#L184-L194https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108643#bot", "creation_timestamp": "2026-10-10T22:48:41.555531Z"}, {"uuid": "493817b5-e3e8-42d6-9b3b-10b06470907b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108644", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419053006771380", "content": "CVE-2026-108644 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108644https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysCategoryController.java#L165-L177https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-delete#jeecgboot #JeecgBoot#CVE_2026_108644#bot", "creation_timestamp": "2026-10-10T22:49:22.191417Z"}, {"uuid": "363b5dd9-2ad1-4af6-bcce-f22a9a0345f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108645", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419055649527713", "content": "CVE-2026-108645 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108645https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c082_category_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysCategoryController.java#L147-L158https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-edit#jeecgboot #JeecgBoot#CVE_2026_108645#bot", "creation_timestamp": "2026-10-10T22:50:02.561034Z"}, {"uuid": "033a708f-f88f-4285-91d4-d3908c4cd356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108647", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419060933183407", "content": "CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108647https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c084_checkrule_import_xlsx.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysCheckRuleController.java#L192-L208https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-checkrule-importexcel#jeecgboot #JeecgBoot#CVE_2026_108647#bot", "creation_timestamp": "2026-10-10T22:51:23.310929Z"}, {"uuid": "a406df56-5eae-497c-994f-3b0bbce321ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108652", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419074181948213", "content": "CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image URL, to replace administrators' avatars.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108652https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_update_avatar.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L830-L833https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-updateavatar#jeecgboot #JeecgBoot#CVE_2026_108652#bot", "creation_timestamp": "2026-10-10T22:54:45.306064Z"}, {"uuid": "9851bb3b-7a9d-45c8-84e1-c0a6b38d6a19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108646", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419058288398024", "content": "CVE-2026-108646 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, including under existing parent nodes.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108646https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c083_category_import_xlsx.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysCategoryController.java#L265-L339https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-category-importexcel#jeecgboot #JeecgBoot#CVE_2026_108646#bot", "creation_timestamp": "2026-10-10T22:50:42.954270Z"}, {"uuid": "133efc46-4956-4778-b73a-c8b01b0ad89c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108648", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419063577355212", "content": "CVE-2026-108648 JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108648https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L358-L361https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-getdynamicdbsourcebycode-endpoint#jeecgboot #JeecgBoot#CVE_2026_108648#bot", "creation_timestamp": "2026-10-10T22:52:03.601136Z"}, {"uuid": "6ecb9a62-47e1-4f27-8932-d92b37b2fc0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108649", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419066221321022", "content": "CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and identify administrator accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108649https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_user_roles_by_id.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L482-L485https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-queryuserrolesbyid#jeecgboot #JeecgBoot#CVE_2026_108649#bot", "creation_timestamp": "2026-10-10T22:52:44.010585Z"}, {"uuid": "87d00371-e508-47f8-b498-f26c18a53414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108650", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419068896189719", "content": "CVE-2026-108650 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108650https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c096_sys_api_permission_set.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L450-L453https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-getuserpermissionset#jeecgboot #JeecgBoot#CVE_2026_108650#bot", "creation_timestamp": "2026-10-10T22:53:24.662794Z"}, {"uuid": "b6df5e73-5ed4-4e06-95ef-a405e14d2b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108651", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419071539559508", "content": "CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108651https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c095_sys_api_roles.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L155-L158https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-getrolesbyuserid#jeecgboot #JeecgBoot#CVE_2026_108651#bot", "creation_timestamp": "2026-10-10T22:54:05.048569Z"}, {"uuid": "33b3d183-9da1-4343-a48b-7b5c6bcb103b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108653", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419076825474176", "content": "CVE-2026-108653 JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108653https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_openapi_config_and_call_gateway.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java#L73-L80https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-get-openapi-list#jeecgboot #JeecgBoot#CVE_2026_108653#bot", "creation_timestamp": "2026-10-10T22:55:26.397097Z"}, {"uuid": "4db5de2e-abd9-4095-85c0-60ae132c3a01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108654", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419079466671616", "content": "CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file names and direct storage URLs of files uploaded by other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108654https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_record_query_by_id.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/oss/controller/OssFileController.java#L84-L97https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-oss-file-querybyid#jeecgboot #JeecgBoot#CVE_2026_108654#bot", "creation_timestamp": "2026-10-10T22:56:06.099861Z"}, {"uuid": "c19d5aa0-2302-4a6b-971a-4020868e41b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108655", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419082107022430", "content": "CVE-2026-108655 JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108655https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_record_query_by_id.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/quartz/controller/QuartzJobController.java#L194-L198https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-quartzjob-querybyid#jeecgboot #JeecgBoot#CVE_2026_108655#bot", "creation_timestamp": "2026-10-10T22:56:46.304841Z"}, {"uuid": "e8a9209c-b866-4820-81f4-f7ea36ff65f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108656", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419084750234647", "content": "CVE-2026-108656 JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108656https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_ownership_and_pack_approval.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L816-L820https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-gettenantpackapplyusers-endpoint#jeecgboot #JeecgBoot#CVE_2026_108656#bot", "creation_timestamp": "2026-10-10T22:57:26.733734Z"}, {"uuid": "82cedb55-84b3-4d96-925c-c4fefe6ea87a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108657", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419087387810872", "content": "CVE-2026-108657 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108657https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_ownership_and_pack_approval.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L838-L842https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-passapply#jeecgboot #JeecgBoot#CVE_2026_108657#bot", "creation_timestamp": "2026-10-10T22:58:06.827727Z"}, {"uuid": "15a66f1a-db5e-478a-9d42-dc5011f08c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108658", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419090028183122", "content": "CVE-2026-108658 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108658https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_ownership_and_pack_approval.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L870-L874https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-querytenantauthinfo#jeecgboot #JeecgBoot#CVE_2026_108658#bot", "creation_timestamp": "2026-10-10T22:58:47.354308Z"}, {"uuid": "9b6da378-7058-4970-b36e-03385c6dee4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108659", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419092671660453", "content": "CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108659https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_pack_by_user.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L1034-L1047https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-listpackbytenantuserid#jeecgboot #JeecgBoot#CVE_2026_108659#bot", "creation_timestamp": "2026-10-10T22:59:27.620082Z"}, {"uuid": "ae9dc5a6-c8dc-4568-8363-415ba00bbd52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108660", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419095314904927", "content": "CVE-2026-108660 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108660https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_apply_status_toggle.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L799-L808https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-updateapplystatus#jeecgboot #JeecgBoot#CVE_2026_108660#bot", "creation_timestamp": "2026-10-10T23:00:07.803654Z"}, {"uuid": "a664da6d-c4c2-453b-b4f7-704cfac2cb2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108661", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419097966179046", "content": "CVE-2026-108661 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108661https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_change_owner.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L726-L731https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-changeowenusertenant#jeecgboot #JeecgBoot#CVE_2026_108661#bot", "creation_timestamp": "2026-10-10T23:00:48.374301Z"}, {"uuid": "91e3b230-aded-4d56-9398-ec14db25af44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108662", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419100604612434", "content": "CVE-2026-108662 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108662https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_pack_user_removal.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L787-L791https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-deletetenantpackuser#jeecgboot #JeecgBoot#CVE_2026_108662#bot", "creation_timestamp": "2026-10-10T23:01:28.526125Z"}, {"uuid": "53a15a1c-be4d-4ddb-984b-2f526a6ec325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108663", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419103247571213", "content": "CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108663https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_tenant_delete_apply.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java#L849-L853https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-tenant-deleteapply#jeecgboot #JeecgBoot#CVE_2026_108663#bot", "creation_timestamp": "2026-10-10T23:02:09.368780Z"}, {"uuid": "c1700ac8-1724-46a4-a6d2-1dddbc3e6b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108664", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419105893960831", "content": "CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to obtain prompt text, model parameters, and creator details belonging to administrators or other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108664https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompt_read.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L146-L154https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-querybyid#jeecgboot #JeecgBoot#CVE_2026_108664#bot", "creation_timestamp": "2026-10-10T23:02:49.201303Z"}, {"uuid": "1f2990a0-b1fc-4f4b-acd7-5fb4bf2ea68b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108665", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419108537480502", "content": "CVE-2026-108665 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108665https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompts_recycle.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L103-L109https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-edit#jeecgboot #JeecgBoot#CVE_2026_108665#bot", "creation_timestamp": "2026-10-10T23:03:29.637025Z"}, {"uuid": "73ba852b-1497-4fd6-b5d2-fa87318fc863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108666", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419111176143332", "content": "CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch to remove templates created by administrators or other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108666https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompts_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L131-L137https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108666#bot", "creation_timestamp": "2026-10-10T23:04:09.919678Z"}, {"uuid": "00b0a9a9-4286-4b3a-b355-a281d65f88bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108667", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419113818320329", "content": "CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to clear deleted flags, undoing administrator removals.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108667https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompts_recycle.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L159-L164https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-revertrecyclebin#jeecgboot #JeecgBoot#CVE_2026_108667#bot", "creation_timestamp": "2026-10-10T23:04:50.132702Z"}, {"uuid": "311eb3c6-0911-478c-9d17-be5ee6bf3128", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108668", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419116486620392", "content": "CVE-2026-108668 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108668https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompts_recycle_bin_purge.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L168-L173https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-deleterecyclebin#jeecgboot #JeecgBoot#CVE_2026_108668#bot", "creation_timestamp": "2026-10-10T23:05:30.887952Z"}, {"uuid": "e2ac3d4b-6600-40b4-99ce-540c962fc15c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108669", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419119130972171", "content": "CVE-2026-108669 JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to read document text chunks from unauthorized knowledge bases.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108669https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_data_plane.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java#L348-L355https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-knowledge-embedding-search#jeecgboot #JeecgBoot#CVE_2026_108669#bot", "creation_timestamp": "2026-10-10T23:06:11.525923Z"}, {"uuid": "c509567e-ed32-45c8-a8a6-cf9d97e4da7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108670", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419121779568418", "content": "CVE-2026-108670 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108670https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_data_plane.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L180-L183https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-experiment#jeecgboot #JeecgBoot#CVE_2026_108670#bot", "creation_timestamp": "2026-10-10T23:06:51.604471Z"}, {"uuid": "efdeba6c-2929-45d2-b2d0-a15ece01ffe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108671", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419124419017274", "content": "CVE-2026-108671 JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108671https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_mcp_model_and_writer.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragMcpController.java#L164-L173https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-airagmcp-querybyid#jeecgboot #JeecgBoot#CVE_2026_108671#bot", "creation_timestamp": "2026-10-10T23:07:31.967606Z"}, {"uuid": "75e6ce7f-8c5a-4d4e-9b20-d41075869fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108672", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419127059943866", "content": "CVE-2026-108672 JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108672https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_video_history_read.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/video/controller/VideoGenerationController.java#L77-L81https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-authorization-bypass-via-airag-video-listbyuser#jeecgboot #JeecgBoot#CVE_2026_108672#bot", "creation_timestamp": "2026-10-10T23:08:12.125848Z"}, {"uuid": "dabeaf52-9975-47bd-8441-582085d23eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108673", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419129722694078", "content": "CVE-2026-108673 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108673https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_prompts_export.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java#L184-L193https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-exportxls#jeecgboot #JeecgBoot#CVE_2026_108673#bot", "creation_timestamp": "2026-10-10T23:08:52.899182Z"}, {"uuid": "489eb93c-c1e9-4ed6-a230-66e2a3964884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108674", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419132368777596", "content": "CVE-2026-108674 JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108674https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_openapi_config_and_call_gateway.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java#L150-L154https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-openapi-querybyid#jeecgboot #JeecgBoot#CVE_2026_108674#bot", "creation_timestamp": "2026-10-10T23:09:33.276708Z"}, {"uuid": "3006c99e-8be3-4edb-ae78-3ff45fbe1a69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108675", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419135006592294", "content": "CVE-2026-108675 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108675https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_announcement_edit_iztop_post.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysAnnouncementController.java#L230-L244https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-annountcement-editiztop#jeecgboot #JeecgBoot#CVE_2026_108675#bot", "creation_timestamp": "2026-10-10T23:10:13.565004Z"}, {"uuid": "ba987619-11cd-493b-aad2-f07dca16e003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108676", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419137647104423", "content": "CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108676https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_announcement_file_download.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysAnnouncementController.java#L791-L796https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-annountcement-downloadfiles#jeecgboot #JeecgBoot#CVE_2026_108676#bot", "creation_timestamp": "2026-10-10T23:10:53.737985Z"}, {"uuid": "3e18caf6-006b-43d5-b991-8f2765eb670c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108677", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419140295533689", "content": "CVE-2026-108677 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108677https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L100-L110https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-getuserbyname#jeecgboot #JeecgBoot#CVE_2026_108677#bot", "creation_timestamp": "2026-10-10T23:11:34.139025Z"}, {"uuid": "1bba9cf1-c6f6-4bed-988c-cf8b81af3640", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108679", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419145586520134", "content": "CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to /sys/api/sendBusAnnouncement with forged sender, recipients, title and content to deliver spoofed admin or system messages for phishing.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108679https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L53-L56https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-sendbusannouncement#jeecgboot #JeecgBoot#CVE_2026_108679#bot", "creation_timestamp": "2026-10-10T23:12:55.012907Z"}, {"uuid": "d9981dac-7d38-4b16-8d6d-c3138d5bf16f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108680", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419148234103045", "content": "CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108680https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L62-L65https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-sendtemplateannouncement#jeecgboot #JeecgBoot#CVE_2026_108680#bot", "creation_timestamp": "2026-10-10T23:13:35.430660Z"}]}