EUVD-2026-97052
GHSA-mf5r-54hh-g48q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitEnumerate app ids via /airag/app/listDict
-
ExecutionCall queryById for each id
-
ImpactRead other users' AI app configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on the JeecgBoot instance (PR:L) and network reachability to the application; no user interaction and no special non-default configuration are needed. Exploitation specifically depends on the AIRAG/AI-application module being deployed and the /airag/app/listDict and AiragAppController queryById endpoints being reachable. The limiting factors are the authentication requirement (an attacker must already have at least a low-privilege login) and that only the AI application module is affected; impact is bounded to read-only disclosure of AI app configuration (system/memory prompts, model ids, knowledge base ids, plugin bindings), with no write or availability impact. |
| Impact | This is a genuine but moderate-severity information-disclosure issue, not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent: network-reachable, low attack complexity, but requires low-privileged authentication (PR:L) and yields only low confidentiality impact with no integrity or availability impact. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC), which raises practical exploitability, but no CISA KEV listing and no EPSS score are provided, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals and should not be conflated. SSVC-style reasoning: exploitation is PoC-only, the flaw is automatable (the /airag/app/listDict endpoint lets an attacker enumerate ids and loop queryById), but technical impact is partial (read-only disclosure of AI app configuration, no code execution or data modification). Net assessment: a real, easily-weaponized authorization gap worth patching, but the low confidentiality-only impact and the authentication precondition keep it below high-priority urgency absent evidence of exploitation in a given environment. EPSS is missing, so widespread-vs-targeted exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user calls the unguarded /airag/app/listDict endpoint to enumerate every AI application id in the system, then calls the AiragAppController queryById handler for each id. Because queryById performs no per-object ownership/authorization check (CWE-862), the attacker reads other users' system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings. A working PoC (poc_airag_app_query_by_id.py) is publicly available, making this trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated, low-privileged user to read the AI application configurations of other users by invoking the AiragAppController queryById handler with arbitrary application ids. The companion /airag/app/listDict endpoint lacks its own access control and can be walked to enumerate valid application ids, each of which then discloses system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings belonging to other users. Publicly available exploit code exists (a Python proof-of-concept), and the issue is not listed in CISA KEV as actively exploited; with the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (5.3), this is a genuine but moderate-severity, read-only information-disclosure problem rather than a critical priority.
RemediationAI
No vendor-released patch identified at time of analysis: the provided references point only to the vulnerable source location in commit e3b9dc0 and to the VulnCheck advisory, with no fixed version number published, so upgrade guidance cannot be given as a specific release. Until a vendor fix is available, the most effective mitigation is to remove the attack surface: if the AIRAG module is not in active use, undeploy or disable jeecg-boot-module-airag (and block its /airag/ routes at the gateway or reverse proxy), accepting the loss of AI-application functionality as the trade-off. Where AIRAG is required, add an object-level authorization check to AiragAppController.queryById and to /airag/app/listDict - for example a JeecgBoot data-scope/permission filter or an explicit ownership comparison against the caller's user/tenant id - so that callers can only retrieve applications they own, though this requires custom code maintenance that may diverge from future upstream releases. Additional compensating controls: restrict network access to /airag/ to trusted admin networks or VPN, alert on bulk or sequential enumeration of the listDict/queryById pair (a strong indicator of exploitation given the context given in the description), and rotate or treat as exposed any prompt text, model identifiers, or knowledge-base ids that may have leaked, since disclosure cannot be undone by patching alone. Monitor the JeecgBoot project and the linked VulnCheck advisory for an official fix version before relying on any of the above as a permanent fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform, and the affected component is the optional AIRAG module (jeecg-boot-module-airag), which stores and serves configuration for "AI applications" built on the platform. The root cause is CWE-862 (Missing Authorization): the queryById handler in AiragAppController (see the vulnerable source at the referenced GitHub permalink, commit e3b9dc0, lines 196-203) performs no object-level or ownership check before returning the requested AI application record, and the /airag/app/listDict endpoint is likewise unguarded, acting as an id oracle. Because authorization is enforced only at the "is the caller logged in" level and not at the "does the caller own this object" level, any account with minimal privileges can pivot from enumeration to direct object reads. The affected artifact is captured by the CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* per VulnCheck. Impact is confined to confidentiality of AI app metadata (prompts, model ids, knowledge base ids, plugin bindings) - there is no write or availability impact, and exploitation presupposes that the AIRAG module is deployed and that both endpoints are network-reachable.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires a low-privileged authenticated account (PR:L); read-only config disclosure gives C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and query each id to obtain system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings of other users' applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB