CVE-2026-108605

Received Received - Intake

Missing Authorization in JeecgBoot Allows OCR Template Modification

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108605

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AiOcrController updateById handler. This allows any authenticated user to modify global OCR templates. Attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts stored in the shared airag:ocr Redis key, which corrupts OCR results for all users.

Detection Guidance

Check for unauthorized PUT requests to /airag/ocr/edit endpoints in web server logs. Monitor Redis keys for changes to airag:ocr, particularly modifications to LLM prompts by low-privileged users. Inspect network traffic for suspicious PUT requests targeting the AiOcrController updateById handler.

Impact Analysis

Low-privileged attackers could alter OCR templates, leading to incorrect data extraction from images for all users. This may cause processing errors, data corruption, or misinterpretation of critical information, affecting system reliability and user trust.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, potentially violating integrity requirements in GDPR and HIPAA. Incorrect OCR results may result in non-compliance due to inaccurate data processing or storage, risking legal penalties and reputational damage.

Mitigation Strategies

Apply the latest JeecgBoot patch to version 3.9.5 or higher. Restrict access to /airag/ocr/edit endpoints using authentication and authorization controls. Audit Redis keys for unauthorized modifications and reset airag:ocr to default values if compromised. Implement input validation to prevent unauthorized prompt modifications.

Hi! I’m here to help you understand CVE-2026-108605. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70