CVE-2026-108667

Received Received - Intake

Missing Authorization in JeecgBoot Allows Template Restoration

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to clear deleted flags, undoing administrator removals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108667

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can restore deleted AI prompt templates by exploiting the revertRecycleBin endpoint. Attackers send PUT requests to /airag/prompts/revertRecycleBin with specific template IDs to clear deletion flags, effectively undoing administrator removals.

Detection Guidance

Check for unauthorized PUT requests to /airag/prompts/revertRecycleBin with template IDs. Monitor logs for unusual activity from low-privileged users restoring deleted templates.

Impact Analysis

This vulnerability allows unauthorized users to restore deleted AI prompt templates, potentially reinstating sensitive or outdated content. It undermines data management by administrators and could lead to confusion or misuse of restored templates.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to restore deleted AI prompt templates. This may lead to unauthorized access to sensitive data or actions, violating data integrity and access control requirements in these regulations.

Mitigation Strategies

Update JeecgBoot to the latest version beyond 3.9.5. Restrict access to the revertRecycleBin endpoint. Review logs for past unauthorized restorations and revoke affected templates.

Hi! I’m here to help you understand CVE-2026-108667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70