EUVD-2026-96605
GHSA-g34v-99hm-jj22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate template IDs via unguarded list endpoint
-
ExecutionSubmit IDs to deleteBatch (no authz check)
-
ImpactDelete other users' AI prompt templates
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level (CVSS PR:L) - exploitation is impossible for fully unauthenticated attackers. The attacker must reach the AiragBoot AI prompts module: the list endpoint must be accessible to obtain prompt template IDs, and the AiragPromptsController deleteBatch handler must be exposed, which it is by default in JeecgBoot through 3.9.5. No special non-default configuration, no user interaction, and no elevated role are needed. The practical limiting factor is account provisioning: risk is meaningful mainly in multi-tenant or broadly self-registering deployments where low-privileged accounts coexist with admin-created prompt templates. |
| Impact | This is a genuine but modest-priority issue, not a high-CVSS alarm. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-862 agree with the description: a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account and no user interaction. Impact is correctly scoped to integrity and availability of AI prompt templates (VI:L/VA:L) with no confidentiality loss (VC:N) and no scope change, yielding a legitimate MEDIUM 5.3. A public PoC (VulnCheck/github-poc) raises practical exploitability, but this signals only that exploit code exists - it is NOT evidence of active exploitation. No CISA KEV listing and no EPSS score were provided; absence of KEV plus the authenticated-only, limited-data-destruction impact means this is unlikely to see mass automated exploitation. The main caveat: exploitation depends on an attacker already holding a valid low-privileged JeecgBoot account, which bounds real-world risk to multi-tenant or broadly-provisioned deployments. CVSS and description are internally consistent - no conflicting signals requiring vendor verification. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user queries the unguarded AI prompt list endpoint to enumerate prompt template IDs belonging to administrators or other users, then submits those IDs to the deleteBatch handler of AiragPromptsController, which performs no ownership or role check and deletes them. A public Python PoC (poc_airag_prompts_delete_batch.py) automates this. Because the vector is network, low-complexity, and needs no user interaction, any authenticated account can destroy others' templates in a single request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user, regardless of role, to delete administrator-created AI prompt templates through the deleteBatch handler of AiragPromptsController. The unguarded list endpoint lets a low-privileged attacker enumerate prompt IDs and feed them to deleteBatch, destroying templates belonging to admins or other tenants; exploitation requires only a valid account (CVSS vector PR:L) and no user interaction or elevated role. Publicly available exploit code exists (a PoC script targeting the deleteBatch endpoint has been published), but there is no confirmation of active exploitation in the wild, and the practical risk is concentrated in multi-tenant or self-registering deployments where low-privileged accounts coexist with administrator content.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so remediation must start with compensating controls while tracking the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-deletebatch) for an upstream fix. The most direct mitigation is to add an authorization check - for example an admin/owner permission annotation or an explicit ownership comparison - to the deleteBatch method in AiragPromptsController (and to the list endpoint used for ID enumeration), since the vulnerable handler at lines 131-137 performs no such validation; note this requires maintaining a local code patch across upgrades. If the AI prompts feature is not in use, disable or undeploy the jeecg-boot-module-airag module, which removes the attack surface entirely but disables all AI prompt functionality. Where the module is required, restrict network access to the airag prompts endpoints (blocking external/untrusted clients via reverse proxy, gateway rules, or firewall) - effective against external attackers but not against malicious low-privileged internal users. Finally, reduce the pool of attackable accounts by tightening account provisioning: disable or gate open self-registration and audit/limit low-privileged accounts in multi-tenant deployments, and monitor for unexpected deletion requests to the deleteBatch endpoint as a detection backstop; these measures lower likelihood but do not fix the underlying missing authorization. A publicly available PoC (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_prompts_delete_batch.py) should be treated as proof that exploitation is trivial for any authenticated user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose optional AiragBoot module manages AI prompt templates; the affected code lives in jeecg-boot-module-airag under org.jeecg.modules.airag.prompts.controller.AiragPromptsController (deleteBatch handler, lines 131-137 of the referenced commit). The root cause is CWE-862 (Missing Authorization): the controller method performs no ownership or permission check, so any caller holding a valid session can delete arbitrary prompt records, while the companion list endpoint exposes prompt IDs without authorization as well. Authentication is enforced by the platform (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), but authorization is not, so the vulnerability is a horizontal/vertical privilege failure rather than an authentication bypass - the 'Authentication Bypass' tag in the source data reflects the missing authorization check, not a lack of login. Impact is limited to integrity and availability of AI prompt template data (no confidentiality impact, no scope change), consistent with the modest CVSS score of 5.3.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable handler, low complexity, needs a low-privileged authenticated account (PR:L), no UI; deleting templates harms integrity and availability only, so C:N/I:L/A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch to remove templates created by administrators or other users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB