CVE-2026-86228

Received Received - Intake

Improper Access Control in JeecgBoot via Credential Manipulation

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description

A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-06

Generated

2026-09-07

AI Q&A

2026-09-07

EPSS Evaluated

N/A

NVD

CVE-2026-86228

EUVD

EUVD-2026-72178

Affected Vendors & Products

Vendor	Product	Version / Range
jeecg	jeecgboot	to 3.9.3 (inc)
jeecg	jeecgboot	3.9.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in JeecgBoot versions up to 3.9.3. It involves improper access controls in the exportXls function due to manipulation of the credential argument in the AiragModelController.java file. The flaw allows remote attackers to exploit it without authentication.

Detection Guidance

To detect this vulnerability, check if your JeecgBoot version is up to 3.9.3. Inspect the file jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java for the exportXls function. Look for improper access control issues related to the credential argument.

Impact Analysis

The vulnerability may allow unauthorized access to sensitive data or functions if the credential argument is manipulated. Attackers could remotely exploit this to gain improper access, potentially leading to data breaches or unauthorized system actions.

Compliance Impact

The vulnerability allows improper access controls due to manipulation of the credential argument in JeecgBoot up to 3.9.3. This could lead to unauthorized data access or disclosure, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.5 or later. Apply the patch with the commit hash a2be896f753936956ee6863b632b8e5a0231345c to resolve the improper access control issue.

Hi! I’m here to help you understand CVE-2026-86228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70