EUVD-2026-96608
GHSA-fw8c-mrrp-f79j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate target knowledge base IDs
-
ExploitCall /airag/knowledge/embedding/search
-
ExecutionServer skips Shiro authorization check
-
ImpactExfiltrate unauthorized document text chunks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated account on the target JeecgBoot instance (CVSS PR:L) and that the AiRAG knowledge-base module be deployed and in use with embedding search enabled; the attacker must know or enumerate valid knowledge base IDs to target. The limiting factors are: authentication is mandatory (no anonymous access), impact is confined to reading document text chunks (confidentiality only - no write or service impact), and the deployment must actually host the AiRAG module and contain knowledge bases belonging to other users/tenants for the disclosure to be meaningful. No special non-default toggle beyond normal AiRAG usage is cited in the description. |
| Impact | This is a genuine but moderate-severity issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-862 (Missing Authorization) are internally consistent with the description: a network-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L) and yields only low confidentiality impact (VC:L) with no integrity or availability effect. The 5.3 score correctly reflects a read-only broken-access-control (IDOR-style) weakness rather than a full compromise. Publicly available exploit code exists (POC published, reported by VulnCheck), which raises practical risk and lowers the barrier to opportunistic use, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation at time of analysis. The POC availability and active-exploitation signals must not be conflated - a working POC against a low-privilege data-disclosure bug typically drives targeted or post-authentication abuse rather than mass exploitation. Net: a real, patch-worthy priority for organizations running JeecgBoot with its AiRAG module and multiple tenants/users, but materially below critical given the authentication requirement and confidentiality-only impact. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a JeecgBoot deployment enumerates or guesses knowledge base IDs and issues GET /airag/knowledge/embedding/search requests for bases they do not own, reading back document text chunks from other users' or tenants' private knowledge bases. Because the embeddingSearch handler lacks the Shiro permission annotation, the server returns the data without an authorization check. A public POC (poc_airag_data_plane.py) already automates this against the AiRAG data-plane endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot's AiRAG knowledge module lets low-privileged authenticated users read document text chunks from knowledge bases they do not own. The embeddingSearch handler in AiragKnowledgeController (GET /airag/knowledge/embedding/search) lacks Shiro permission annotations, so any valid account can pass arbitrary knowledge base IDs and retrieve indexed content belonging to other users or tenants. Exploitation is remote and requires authentication (CVSS:4.0 PR:L, assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), impact is limited to confidentiality, and publicly available exploit code exists (a Python PoC targeting the data plane); no confirmed active exploitation has been reported. This is a genuine but moderate-severity issue, not a top-tier emergency.
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis; the flaw is stated as affecting JeecgBoot through 3.9.5, so treat any post-3.9.5 release or vendor commit as unverified until JeecgBoot confirms the fix and cite the advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-knowledge-embedding-search when tracking status. Until a fix is confirmed, the highest-value compensating control is to add an explicit authorization check on the embeddingSearch handler (for example a Shiro @RequiresPermissions annotation plus a server-side ownership check that the requested knowledge base id belongs to the caller or their tenant) - this is a code change and must be re-applied after every upgrade. Where code changes are not feasible, block GET /airag/knowledge/embedding/search at the reverse proxy, WAF, or Spring Security/Shiro filter chain for all but trusted administrative roles; the trade-off is that legitimate RAG embedding-search functionality becomes unavailable to normal users. If the module is not required, disable or undeploy jeecg-boot-module-airag entirely, which removes the endpoint and its exposure. Additionally, restrict the AiRAG knowledge-base feature to a small set of accounts, log and alert on knowledge base id enumeration patterns or on a single session querying many distinct ids, and rotate or restrict access to any sensitive documents already ingested into knowledge bases, since public exploit code exists and the disclosure is limited to confidentiality (no write or availability impact).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose AiRAG module adds retrieval-augmented generation over user-managed knowledge bases. In affected builds, the AiragKnowledgeController class exposes an embedding search endpoint that returns embedded text chunks from a knowledge base selected by a client-supplied id, but the handler method (source lines ~348-355 in the linked repository) carries no Shiro authorization annotation such as @RequiresPermissions or an equivalent role check. Because the platform's Shiro filter chain does not require a specific permission for this path, request-level access control is effectively deferred to nothing, and the only constraint on the caller is possessing any authenticated session. The defect maps to CWE-862 (Missing Authorization) and is functionally an object-level authorization / IDOR-style flaw: the identifier of the target knowledge base is trusted from the request without verifying that the caller owns or may read that resource. Attackers able to enumerate or guess knowledge base identifiers can pivot the endpoint into a cross-tenant data-disclosure primitive, harvesting the raw document chunks that were ingested into other knowledge bases. The supplied CPE (cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*) indicates the flaw is tracked against the JeecgBoot product line generally through version 3.9.5 rather than a single narrow build.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity; PR:L because a low-privileged authenticated account is required; C:L for limited document-chunk disclosure, no integrity or availability impact, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to read document text chunks from unauthorized knowledge bases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB