EUVD-2026-72178
GHSA-3w57-w8jf-q76r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege JeecgBoot credentials
-
DeliveryAuthenticate to application remotely
-
ExploitSend crafted HTTP request to exportXls endpoint
-
ExecutionManipulate credential parameter to bypass authorization
-
ImpactReceive Excel export containing LLM API credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated JeecgBoot session with at minimum a low-privileged account (PR:L per CVSS 4.0); unauthenticated external attackers cannot directly exploit this vulnerability. The AI-RAG module (jeecg-boot-module-airag) must be deployed and reachable - instances that do not use the AI-RAG feature are not exposed to this endpoint. The attack is fully network-accessible (AV:N) with no user interaction required beyond the attacker's own authenticated HTTP request. No special configuration beyond a functioning JeecgBoot instance with the AI-RAG module enabled is required to reach the vulnerable exportXls endpoint. |
| Impact | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) accurately reflects constrained impact - authentication is required (PR:L) and the confidentiality effect is limited (VC:L) with no integrity or availability consequences. The E:P designation confirms a public proof-of-concept exists, substantially lowering the exploitation barrier for any insider or low-privileged attacker with application access. The credential data at risk is LLM API keys or service connection strings, whose compromise could enable unauthorized use of paid AI services or access to sensitive data processed by those models - making real-world impact meaningfully higher than the CVSS score alone conveys. Even a mid-sized enterprise IT team in sopot running JeecgBoot as their internal application platform should treat this as an urgent patch given POC availability and the sensitivity of AI service credentials. The 'Authentication Bypass' tag is mislabeled: CVSS PR:L confirms authentication IS required; this is an authorization bypass, not an authentication bypass. No EPSS data or CISA KEV listing was provided in the input; no public exploit weaponization beyond the PoC is identified. |
| Exploit ScenarioDerived | An attacker with a basic authenticated JeecgBoot account - such as an internal employee or a user whose credentials were obtained via phishing - sends a crafted HTTP request to the AI-RAG model exportXls endpoint, manipulating the credential parameter to bypass the access control check. The server responds with an Excel file containing LLM provider API keys or connection credentials that the attacker can then use to make unauthorized calls to external AI services. A public PoC on GitHub issue #9600 makes this attack straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
RemediationAI
Upgrade JeecgBoot to version 3.9.5 or later, available at https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.5; the fix is in commit a2be896f753936956ee6863b632b8e5a0231345c. If an immediate upgrade is not feasible, restrict access to the AI-RAG exportXls endpoint via Spring Security role configuration so that only administrator-level roles can invoke AiragModelController export functions - this limits the attack surface to privileged accounts only. Additionally, rotate any LLM API keys or service credentials stored in the JeecgBoot AI model configuration as a precaution, since any low-privileged authenticated user on versions up to 3.9.3 may have already retrieved them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java Spring Boot low-code rapid-development platform with a modular architecture. The vulnerable component is jeecg-boot-module-airag, which provides AI Retrieval-Augmented Generation functionality including integration with external LLM providers. The exportXls function in AiragModelController.java performs an Excel export of AI model configuration records, including sensitive credential fields. CWE-284 (Improper Access Control) is the root cause: the endpoint fails to verify whether the authenticated caller holds authorization to read model credential data, allowing any authenticated user to retrieve credentials intended for administrators. The CPE string carries a placeholder vendor 'n/a' rather than the actual jeecg organization; the product is correctly identified as jeecgboot.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint requires low-privileged authentication; confidentiality impact limited to credential data, with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB