JeecgBoot
CVE-2026-9604
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the argument list/queryById results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 3.9.2 is able to resolve this issue. The affected component should be upgraded.
AnalysisAI
Improper access control in JeecgBoot's AiragModelController (versions up to 3.9.1) permits any authenticated low-privilege user to invoke the list and queryById API endpoints without proper authorization checks, exposing AI RAG model configuration data restricted to higher-privileged roles. The CVSS vector (PR:L, C:L) confirms this is an authorization bypass rather than a full authentication bypass, limiting impact to confidentiality of AI model metadata. Publicly available exploit code exists (GitHub issue #9599, referenced in the exploit tag), though no CISA KEV listing indicates confirmed widespread active exploitation at time of analysis.
Technical ContextAI
JeecgBoot is a Java-based low-code rapid development platform integrating Spring Boot, MyBatis-Plus, and an AI/RAG (Retrieval-Augmented Generation) layer. The affected component, AiragModelController, is part of the platform's AI assistant subsystem introduced in recent versions to manage AI model configurations. CWE-284 (Improper Access Control) is the root cause: the controller's list and queryById action handlers lack role or permission gate enforcement, meaning the application's access control policy is either absent or incorrectly applied at the endpoint level. The CPE (cpe:2.3:a:n/a:jeecgboot:*:*:*:*:*:*:*:*) reflects that NVD has not yet assigned a formal vendor identifier. The v3.9.2 release notes confirm a broader security hardening pass that added permission validation to MCP and underlying sensitive AI tools ('给 MCP / 底层敏感工具 全面加上权限校验'), corroborating that this class of endpoint was systematically under-protected.
RemediationAI
The vendor-released patch is JeecgBoot v3.9.2, available at https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2. Upgrading to v3.9.2 is the primary and recommended fix, as it applies permission validation to the AiragModelController and related AI tool endpoints. If immediate upgrade is not feasible, a compensating control is to restrict access to the AiragModelController endpoints (list, queryById) at the API gateway or reverse proxy layer to only administrator-role sessions - note this requires knowing the exact route paths from the JeecgBoot route configuration and may break legitimate admin UI functionality if not scoped precisely. For multi-tenant deployments, review whether the cross-tenant isolation fixes noted in v3.9.2 (AiragApp cross-tenant write, #9462; Token privilege escalation, #9518) also apply to your environment, as these represent a related class of access control deficiencies patched in the same release.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today