JeecgBoot CVE-2026-108670

Requires a valid authenticated low-privileged account on the target JeecgBoot instance (PR:L), and the JeecgBoot AIRAG/AI-prompts module must be deployed and configured with a working LLM backend for evaluation runs to execute. The attacker must also know or enumerate valid prompt-template and dataset IDs owned by other users, which the promptExperiment handler accepts without any ownership/authorization check. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, is scoped to environments that actually use the AIRAG feature, and impact is restricted to writing rows into airag_ext_data and changing dataset status (integrity) rather than data theft or service outage.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: exploitation is network-reachable and technically simple, but requires an authenticated low-privileged account (PR:L), and impact is confined to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect. A public exploit exists (VulnCheck advisory plus a GitHub PoC), which raises operational concern, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals and should not be conflated here. The SSVC-style read is: exploitation = public PoC (not 'active'), technical impact = partial (integrity-only cross-user data manipulation), and the authentication precondition limits automatability against arbitrary targets. One signal worth flagging: the described ability to trigger large-language-model evaluation runs on demand implies a potential resource/cost-abuse angle (compute spend against the configured LLM backend) that the CVSS vector does not capture under availability. Net: a legitimate authorization defect worth patching in affected JeecgBoot deployments, but below the urgency of an unauthenticated RCE or a KEV-listed flaw.

A low-privileged but authenticated JeecgBoot user calls the promptExperiment endpoint of AiragPromptsController and supplies prompt-template and dataset IDs belonging to a different user. Because the handler performs no ownership check, the server runs the AI prompt experiment on the victim's resources, writes attacker-influenced result rows into airag_ext_data, and flips the victim's dataset status. A public proof-of-concept (poc_airag_data_plane.py) demonstrating this request is available.