CVE-2026-108609

Received Received - Intake

JeecgBoot Insecure Direct Object Reference Exposes AI Voice History

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108609

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has an insecure direct object reference vulnerability. Authenticated users can access other users' AI voice generation history by manipulating the userId parameter in the GET /airag/voice/listByUser endpoint. This allows attackers with knowledge of another user's ID to retrieve sensitive data such as submitted text-to-speech input, voice settings, timestamps, and generated audio file paths stored in Redis.

Detection Guidance

Check for unauthorized access to the /airag/voice/listByUser endpoint by monitoring HTTP GET requests with the userId parameter. Look for requests where authenticated users access other users' data without proper authorization.

Impact Analysis

If you are a user of JeecgBoot, an attacker could exploit this to access your AI voice generation history, including any sensitive text inputs or audio files you generated. This could lead to privacy breaches, exposure of confidential information, or misuse of your voice data. Organizations using this software may face reputational damage or legal consequences if user data is compromised.

Compliance Impact

This vulnerability could violate GDPR by failing to protect personal data and user privacy, leading to potential fines. For HIPAA, if voice data includes protected health information, unauthorized access could result in compliance violations and penalties. Organizations must ensure proper access controls to meet regulatory requirements.

Mitigation Strategies

Update JeecgBoot to the latest version beyond 3.9.5. Implement proper authorization checks to ensure users can only access their own AI voice generation history. Restrict access to the userId parameter and validate user permissions on all requests.

Hi! I’m here to help you understand CVE-2026-108609. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70