CVE-2026-108608

Received Received - Intake

Insecure Direct Object Reference in JeecgBoot Allowing Unauthorized Deletion of AI Voice Records

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108608

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has an insecure direct object reference vulnerability. Authenticated users can delete other users' AI voice records by providing an arbitrary userId to the DELETE /airag/voice/deleteVoiceRecord endpoint. Attackers can obtain record IDs from the unprotected GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one record per request.

Detection Guidance

Check for unauthorized DELETE requests to /airag/voice/deleteVoiceRecord with arbitrary userId parameters. Monitor Redis for unexpected deletions of text-to-speech history entries. Review logs for GET /airag/voice/listByUser requests accessing user records not belonging to the requester.

Impact Analysis

This vulnerability allows attackers with valid credentials to delete other users' AI voice records, potentially causing data loss or privacy breaches. Victims may lose important voice records or text-to-speech history, which could impact their work or personal data stored in the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized deletion of user data. GDPR requires data integrity and protection, while HIPAA mandates safeguarding protected health information. Unauthorized deletion of records may violate these regulations.

Mitigation Strategies

Update JeecgBoot to version 3.9.5 or later. Implement proper authorization checks to ensure users can only delete their own voice records. Restrict access to GET /airag/voice/listByUser to prevent enumeration of user IDs.

Hi! I’m here to help you understand CVE-2026-108608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70