EUVD-2026-96607
GHSA-88f7-xrj2-q4pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitSend DELETE to deleteRecycleBin with others' template IDs
-
ImpactPermanently purge admin/other-user recycle-bin templates
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot session at minimum privilege (PR:L) and a deployment running the AIRAG prompts module where the AiragPromptsController deleteRecycleBin handler is reachable. The attacker sends DELETE requests carrying the prompt-template IDs of other users or administrators; no user interaction, no admin role, and no special non-default configuration are needed beyond the AIRAG feature being present. Limiting factors: fully unauthenticated outsiders cannot exploit it, impact is confined to deletion of recycle-bin AI prompt templates (no confidentiality exposure, no code execution), and instances not using the AIRAG module are unaffected. |
| Impact | This is a medium-severity, low-real-world-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw but explicitly requires an authenticated low-privileged account (PR:L), so it is not a pre-auth mass-exploitation candidate. Impact is narrow: VC:N (no confidentiality loss) with only VI:L/VA:L, reflecting unauthorized deletion of AI prompt-template records rather than code execution or broad data compromise. A public exploit exists (VulnCheck advisory plus a GitHub PoC), which raises operational concern, but publicly available exploit code exists is not the same as active exploitation: there is no CISA KEV listing. No EPSS score was provided in the input, so exploitation probability cannot be quantified here - verify EPSS before deprioritizing or escalating. Net assessment: a genuine broken-access-control (CWE-862) bug worth patching, but its authentication requirement and limited, data-destruction-only impact keep it well below critical priority; it is a 'medium CVSS, modest real risk' issue rather than an urgent threat. |
| Exploit ScenarioDerived | A user with any low-privileged JeecgBoot account authenticates normally, then issues DELETE requests to the AiragPromptsController deleteRecycleBin endpoint supplying prompt-template IDs belonging to administrators or other users. Because the handler does not verify ownership or role, the targeted recycle-bin templates are permanently purged. A public PoC (poc_airag_prompts_recycle_bin_purge.py) automates this request, and the low attack complexity makes it trivially repeatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Permanent deletion of other users' recycled AI prompt templates is possible in JeecgBoot through 3.9.5 because the AiragPromptsController deleteRecycleBin handler performs no authorization check. Any authenticated user - including the lowest-privileged account, since the assessed vector is PR:L - can issue a DELETE request carrying arbitrary prompt-template IDs and purge recycle-bin entries that belong to administrators or other tenants; no admin role, user interaction, or special configuration is needed beyond the AIRAG module being present. Publicly available exploit code exists (a PoC script targeting this endpoint), though there is no confirmed active exploitation (not in CISA KEV). Our independent assessment rates this as medium severity (CVSS:3.1 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) and a low-real-world-priority issue: integrity-only impact confined to deletion of soft-deleted template records, with no confidentiality exposure, no code execution, and fully unauthenticated outsiders unable to exploit it.
RemediationAI
No vendor-released patch identified at time of analysis; the only supplied code reference (commit e3b9dc0, AiragPromptsController.java#L168-L173) shows the vulnerable implementation, not a fix, and the advisories from VulnCheck and the CVE record describe the flaw without announcing a corrected version - so treat 3.9.5 as the latest known-affected release and track https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-deleterecyclebin for an updated build. Until a patched release appears, apply these compensating controls: if the AIRAG prompt feature is not required, remove or disable the jeecg-boot-module-airag module (side effect: all AI prompt-template functionality disappears, which is acceptable where the feature was never used); where AIRAG is needed, restrict the deleteRecycleBin endpoint with a gateway/Spring Security rule that permits it only to explicitly trusted administrative roles or the owning user, or back-port an ownership/permission check (e.g., verifying template ownership or adding @PreAuthorize/@RequiresPermissions) into the handler before deletion - the trade-off is that an overly broad filter can block legitimate administrative cleanup workflows, so test role mappings first. Additionally, alert on DELETE requests to the airag prompts recycle-bin path and on mass deletions by non-admin accounts, and consider making recycle-bin purges recoverable via database backups, since the impact is permanent destruction of soft-deleted template records with no confidentiality or code-execution risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose AI module (jeecg-boot-module-airag) exposes REST controllers for managing AI prompt templates. The AiragPromptsController.java source referenced at lines 168-173 implements deleteRecycleBin, an endpoint intended to let users permanently remove prompt templates they previously soft-deleted into a recycle bin. The handler deletes records by ID without verifying that the caller owns the template or holds an administrative permission, a textbook CWE-862 (Missing Authorization) flaw: authentication is enforced, but object-level/role authorization is absent. Because the underlying data layer accepts attacker-supplied IDs directly, the missing check is what allows a low-privileged session to act on resources belonging to other principals. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms the affected component is the JeecgBoot application itself (all versions through 3.9.5) rather than a third-party dependency, and the referenced commit e3b9dc0 shows the vulnerable code path rather than a fix.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network endpoint needing only a low-privileged account (AV:N, AC:L, PR:L); unauthorized deletion of others' records gives limited integrity and availability impact with no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB