EUVD-2026-96552
GHSA-5wwp-r26m-h74c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend POST to /airag/app/release for victim's app ID
-
ExploitBypass missing authorization check in release handler
-
ExecutionObtain share token or invalidate share link
-
ImpactExpose AI application to anonymous access or deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account with low privileges (PR:L) and network reachability to the application's HTTP interface; the target must be running the airag (AI application) module on version 3.9.5 or earlier with at least one AI application owned by another user. No special non-default configuration or user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the authentication requirement - anonymous unauthenticated internet attackers cannot exploit it directly, making this an insider or compromised-credential threat. |
| Impact | This is a moderate, authorization-focused flaw (CWE-862) rather than a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms it is network-reachable and low-complexity but requires an authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to users who already hold JeecgBoot credentials. Impact is limited to integrity and availability of other users' AI applications (VI:L/VA:L) with no confidentiality impact rated by the vendor (VC:N), consistent with the 5.3 base score. Publicly available exploit code exists (VulnCheck-published POC), which raises operational concern, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation at this time. Note the apparent tension: the share-token exposure described ('exposing applications to anonymous chat access') sounds like a confidentiality consequence, yet the vendor scored VC:N and treated it purely as an integrity/availability change - verify whether leaked application content constitutes a confidentiality impact in your environment. Overall: a real but bounded low-privilege/insider abuse issue, not an internet-facing unauthenticated emergency. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user sends a crafted POST request to /airag/app/release referencing an AI application they do not own. Because the release handler omits an ownership/authorization check, the server publishes the victim's application and returns a share token granting anonymous chat access, or unpublishes it to invalidate existing share links. A public proof-of-concept script (poc_airag_app_release.py) demonstrating this is already available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot 3.9.5 and earlier allows any authenticated low-privileged user to publish or unpublish AI applications owned by other users by sending a POST request to /airag/app/release, enabling them to harvest share tokens that expose other tenants' AI applications to anonymous chat access or to invalidate existing share links. The defect is CWE-862, and the assessed impact is limited to low integrity and low availability with no confidentiality loss, scored 5.3 (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; vendor-supplied CVSS 4.0 vector similarly shows PR:L with VI:L/VA:L). Publicly available exploit code exists, but there is no confirmation of active exploitation (no CISA KEV listing in the provided data). Because the vector requires PR:L and UI:N, the realistic threat is an insider or an attacker holding compromised low-privileged credentials with network reachability to the airag module, not an anonymous internet attacker.
RemediationAI
No vendor-released patch is identified at time of analysis - the supplied references point only to the affected source code and the VulnCheck advisory, with no fixed version named - so remediation currently depends on compensating controls while tracking https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-app-release-endpoint for a patched release. The durable fix is to add an ownership/role check to the AiragAppController release handler so that only the application owner or an administrator can toggle release state before any share token is issued or invalidated. Until that is deployed: restrict POST /airag/app/release at the reverse proxy or WAF to administrator and verified application-owner roles, accepting the trade-off that legitimate owners publishing from unmanaged networks are also blocked and that URL rewriting or alternate routes can bypass the rule; disable the airag module entirely on instances where AI application publishing and anonymous chat sharing are not required, accepting the loss of that functionality; audit and revoke or regenerate any share tokens issued for applications the owner did not publish, accepting that rotation breaks legitimate anonymous chat links and requires owner coordination; and review logs for unexpected POSTs to /airag/app/release to identify abuse. Because exploitation requires a valid low-privileged account (PR:L, UI:N) and publicly available exploit code exists (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_app_release.py), also audit and trim dormant or excessive low-privileged JeecgBoot accounts to reduce the pool of credentials an insider or compromised user could leverage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot based low-code development platform; the affected component is the AI application module (jeecg-boot-module-airag), specifically the release handler in AiragAppController (referenced source lines 135-164 at commit e3b9dc0aefe1943d9772b026f64ed671a7c82802). The handler toggles the published/unpublished state of an AI application identified in the request, and it performs no ownership or role check on the caller before mutating that state - the classic CWE-862 missing authorization pattern, in which authentication is enforced at the framework/session level but per-object authorization is never evaluated. The state change has security-relevant side effects: publishing an application causes a share token to be generated that permits anonymous chat access to that application, while unpublishing invalidates the previously issued share link. The provided CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates the flaw is not tied to a single build but to the product line through version 3.9.5. The independent assessment scores this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, which matches the described behavior: an authenticated low-privileged session is sufficient, the attack is trivially automatable over HTTP, and the consequences are unauthorized state modification and denial of an existing sharing capability rather than data disclosure or code execution.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable (AV:N) and simple (AC:L) but needs a low-privileged authenticated account (PR:L); unauthorized publish/unpublish modifies another user's app state (I:L) and link invalidation disrupts availability (A:L), with no direct confidentiality loss rated (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB