CVE-2026-108616

Received Received - Intake

JeecgBoot Missing Authorization in AiragExtDataController

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108616

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AiragExtDataController deleteBatch handler. This flaw allows any authenticated user to delete AI evaluator records. Attackers with low privileges can exploit this by sending comma-separated IDs to the DELETE /airag/extData/deleteBatch endpoint, which lacks checks for ownership or tenant permissions. This results in unauthorized deletion of other users' evaluator and test-tracking records.

Detection Guidance

Check for unauthorized DELETE requests to /airag/extData/deleteBatch with comma-separated IDs. Monitor logs for repeated deletion attempts or unusual access patterns from low-privileged users.

Impact Analysis

This vulnerability can lead to data loss for users, as attackers can delete critical AI evaluator and test-tracking records. It may disrupt workflows, cause incorrect AI model evaluations, and compromise data integrity. Organizations using JeecgBoot for AI-related tasks could face operational disruptions and potential reputational damage.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized data deletion. GDPR mandates data integrity and protection, while HIPAA requires safeguarding protected health information. Unauthorized deletions may result in non-compliance, legal penalties, and loss of trust in data handling practices.

Mitigation Strategies

Apply vendor patches if available. Implement strict access controls to restrict DELETE operations to authorized users only. Review and update API endpoint permissions to enforce tenant and owner checks.

Hi! I’m here to help you understand CVE-2026-108616. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70