Which versions of Java are affected by CVE-2026-5616?

JeecgBoot versions 3.9.0 and 3.9.1 contain a missing authentication vulnerability in the AI Chat Module that allows unauthenticated remote attackers to bypass credential verification and access…. A patch is available.

How to fix or mitigate CVE-2026-5616?

Within 24 hours: Identify all systems running JeecgBoot 3.9.0 or 3.9.1 via asset inventory and network scanning. Within 7 days: Apply vendor patch from GitHub commits b7c9aeba or 2c1cc88b, or upgrade to the next official JeecgBoot release when available; for systems that cannot be patched immediately, restrict network access to the AI Chat Module endpoint using firewall rules or reverse proxy authentication. Within 30 days: Conduct access logs review for any unauthorized AI Chat Module usage and verify all JeecgBoot instances are running patched versions.

Java CVE-2026-5616

Q: What is the CVSS score of CVE-2026-5616?

CVE-2026-5616 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19162 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-06 VulDB

Authentication Bypass Java

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 03:45 euvd

EUVD-2026-19162

Analysis Generated

Apr 06, 2026 - 03:45 vuln.today

Patch released

Apr 06, 2026 - 03:45 nvd

Patch available

CVE Published

Apr 06, 2026 - 03:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.

AnalysisAI

Missing authentication in JeecgBoot 3.9.0 and 3.9.1 allows unauthenticated remote attackers to access the AI Chat Module functionality without credential verification. The vulnerability resides in JeecgBizToolsProvider.java within the jeecg-module-system component. Vendor-released patches are available via GitHub commits (b7c9aeba and 2c1cc88b) pending inclusion in the next official release. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and network attack vector (AV:N) with no authentication required (PR:N) indicate trivial exploitation potential.

Technical ContextAI

JeecgBoot is a Java-based low-code development platform. This vulnerability affects the AI Chat Module (jeecg-airag), specifically the JeecgBizToolsProvider.java class in the jeecg-system-biz component. The issue is classified as CWE-306 (Missing Authentication for Critical Function), meaning the affected functionality fails to enforce authentication checks before granting access. The CVSS vector indicates network accessibility (AV:N) with low complexity (AC:L) and no privileges required (PR:N), suggesting the vulnerable endpoint is exposed without proper authentication middleware or access control filters. The affected code paths in JeecgBizToolsProvider.java likely expose AI chat functionality or business tool operations that should be restricted to authenticated users. The CPE identifier confirms impact to the JeecgBoot product, though specific version enumeration is limited in the provided CPE string.

RemediationAI

Apply the vendor-released patches available via GitHub commits b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39 and 2c1cc88b8d983868df8c520a343d6ff4369d9e59, accessible through pull request #9463 (https://github.com/jeecgboot/JeecgBoot/pull/9463). These commits introduce authentication enforcement to the affected JeecgBizToolsProvider.java component and are scheduled for inclusion in the next official JeecgBoot release. Organizations unable to immediately apply upstream commits should consider temporary mitigations including disabling the AI Chat Module if not operationally required, implementing reverse proxy authentication controls in front of the affected endpoints, or restricting network access to the JeecgBoot application to trusted IP ranges. Monitor the official JeecgBoot GitHub repository (https://github.com/jeecgboot/JeecgBoot/) for the next tagged release version that will incorporate these security fixes. Verify remediation by testing that previously accessible AI Chat Module endpoints now properly enforce authentication requirements.