CVE-2026-108612

Received Received - Intake

Missing Authorization in JeecgBoot Allows Template Deletion

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108612

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler. This flaw allows low-privileged authenticated users to delete word templates by sending a DELETE request to /airag/word/deleteBatch with comma-separated IDs. Attackers can permanently delete any templates in the shared library.

Detection Guidance

Check for unauthorized DELETE requests to /airag/word/deleteBatch with comma-separated IDs. Monitor logs for suspicious activity targeting JeecgBoot instances. Verify if low-privileged users can delete templates in shared libraries.

Impact Analysis

This vulnerability could allow unauthorized users to delete important word templates, leading to data loss or disruption of services that rely on these templates. It may also enable attackers to manipulate shared resources if templates are used for critical documents.

Compliance Impact

This vulnerability allows low-privileged users to delete word templates, potentially leading to unauthorized data deletion. For GDPR, this could impact data integrity and availability, violating principles of lawful processing and accountability. For HIPAA, it may compromise the integrity of protected health information if templates contain such data.

Mitigation Strategies

Update JeecgBoot to version 3.9.5 or later. Implement strict access controls to prevent unauthorized DELETE requests. Restrict template deletion permissions to admin users only.

Hi! I’m here to help you understand CVE-2026-108612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70