EUVD-2026-96612
GHSA-pvqc-57rm-hh62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any low-privilege account
-
DeliveryAuthenticate to JeecgBoot
-
ExploitRequest /airag/prompts/exportXls
-
ExecutionServer skips authorization check
-
ImpactDownload all users' prompts as Excel workbook
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session with any low-privilege JeecgBoot account (PR:L) that can reach the /airag/prompts/exportXls endpoint; the AIRAG prompts module must be present and in use. No special non-default configuration, no user interaction, and no elevated role are needed - the limiting factor is solely possession of a low-level account, so deployments with open registration, shared accounts, or many low-trust users are most exposed. Exploitation is bounded to JeecgBoot versions through 3.9.5 and yields only disclosure of stored AI prompt data (content, model IDs, parameters), with no write or availability impact. |
| Impact | This is a genuine but moderate-severity information-disclosure issue, not a critical priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, with limited confidentiality impact (VC:L) and no integrity or availability impact - consistent with the score of 5.3 and the CWE-862 missing-authorization classification. Publicly available POC code (VulnCheck advisory plus a GitHub exploit script) lowers the practical barrier to exploitation, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation. The signals are internally consistent: a low-privilege authenticated attacker can reliably retrieve data, but impact is confined to disclosure of other users' AI prompts rather than code execution or system compromise. Net assessment: real and easily exploitable in multi-tenant deployments where low-privilege accounts are common, but the capped confidentiality-only impact and the authentication prerequisite keep it below urgent-patch urgency unless the exposed prompt content is itself sensitive. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has obtained any valid low-level account) sends a GET request to /airag/prompts/exportXls. Because the exportXls handler performs no per-record authorization check, the server returns an Excel workbook containing every user's AI prompts - prompt content, model IDs, and parameters - not just the attacker's own. A public POC script (poc_airag_extdata_prompts_export.py) automates this request, making exploitation trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user - including low-privileged accounts - download every user's stored AI prompts by calling the /airag/prompts/exportXls endpoint. The response is an Excel workbook exposing prompt content, model IDs, and parameters belonging to all users, a moderate-severity information disclosure rather than a critical code-execution issue. Publicly available exploit code exists (a PoC script targets this handler), though there is no confirmed evidence of active exploitation (no CISA KEV listing), and exploitation is gated solely on possession of any valid low-privilege session.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis; the only upstream reference is the vulnerable source at a specific commit, not a remediated release, so treat any JeecgBoot deployment on 3.9.5 or earlier as unpatched until jeecgboot publishes a fix - monitor the project repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-prompts-exportxls) for an updated version. Until then, apply compensating controls: add an explicit permission/role annotation or interceptor check on the exportXls mapping and any sibling export endpoints in AiragPromptsController (side effect: legitimate admin exports require the granted role, which most deployments already intend); block or restrict the /airag/prompts/exportXls path at the reverse proxy/WAF for all but trusted administrative source ranges (trade-off: administrators lose convenient remote export and must use an approved network path); disable the AIRAG prompts feature entirely if it is not in active use (trade-off: loses AI prompt functionality); and audit authentication provisioning - close open self-registration, remove shared or default low-privilege accounts, and rotate or remove any exposed prompt content, model IDs, and parameters, since this is squarely an information-disclosure issue with no write or availability impact. Because a PoC is publicly available, prioritize blocking the endpoint over waiting for a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-862 Missing Authorization defect in JeecgBoot, a Spring Boot-based low-code development platform. The AiragPromptsController (jeecg-boot-module-airag, path org/jeecg/modules/airag/prompts/controller/AiragPromptsController.java, around lines 184-193) exposes an exportXls handler that builds and streams an Excel export of the AIRAG prompts table without performing a permission/role check on the caller. Because JeecgBoot's authorization is normally enforced via annotations/filters tied to the request mapping, omitting that check means the only barrier is a valid authenticated session; any principal, regardless of granted permissions, reaches the handler. The underlying data model stores AI prompt definitions including prompt text, associated model identifiers, and generation parameters - useful reconnaissance for prompt-injection, model abuse, or intellectual-property theft. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* with a wildcard version indicates all releases up to and including 3.9.5 are presumed affected unless individually confirmed otherwise.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity and no UI; PR:L because any authenticated low-privilege account suffices; C:L for limited prompt-data disclosure, I/A:N as no modification or disruption occurs.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB