EUVD-2026-97053
GHSA-5w4w-m38r-7r7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft POST to /airag/api/getChatVariable
-
ExploitSupply victim appId, username, variable
-
ExecutionServer reads victim value from Redis
-
ImpactExfiltrate other users' chat variables
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires a valid authenticated JeecgBoot account (PR:L) and that the target deployment runs the AIRAG module exposing the /airag/api/getChatVariable endpoint with chat variables stored in Redis. The attacker must know or enumerate a target appId, victim username, and variable name. Limiting factors: authentication is mandatory, so this is not remotely anonymous; impact is confined to reading other users' AI chat memory values (no write, no code execution); and installations that do not use the AIRAG chat feature are not exposed. No special non-default configuration beyond having the AIRAG feature in use is indicated by the description. |
| Impact | This is a moderate-severity, authenticated authorization flaw (CWE-639, IDOR) rather than a high-urgency issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring low-level privileges (PR:L) - i.e. any authenticated JeecgBoot user - with only limited confidentiality impact and no integrity or availability impact. Public exploit code exists (a VulnCheck-referenced PoC on GitHub), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. The signals are therefore aligned rather than conflicting: a real, easily-triggered data-disclosure bug gated behind authentication, affecting only other users' stored AI chat variables - a priority for multi-tenant JeecgBoot deployments but not an emergency on the scale of an unauthenticated RCE. The main caveat: impact is bounded to chat-memory values in Redis, so real-world severity depends on how sensitive those stored variables are in a given deployment. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privileged JeecgBoot account authenticates, then sends a crafted POST request to /airag/api/getChatVariable supplying another user's appId, username, and a variable name. Because AiragBaseApiController trusts the client-supplied username without verifying ownership, it returns that victim's stored AI chat memory values from Redis. A public PoC (poc_caller_identity_subjects.py) demonstrates this request, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Authenticated users of JeecgBoot through 3.9.5 can read other users' stored AI chat variables through an insecure direct object reference in AiragBaseApiController's /airag/api/getChatVariable endpoint, which trusts a caller-supplied username parameter instead of the authenticated principal. Exploitation requires a valid JeecgBoot account (CVSS 4.0 PR:L) and a deployment that actively uses the AIRAG chat feature with chat variables persisted in Redis, and the attacker must know or enumerate the target appId, victim username, and variable name; impact is confined to confidentiality of chat memory values with no write, integrity, or code-execution effect, and installations not using AIRAG are not exposed. Publicly available exploit code exists (a PoC is published on GitHub), but there is no evidence of confirmed active exploitation, and the moderate CVSS score of 5.3 reflects the authentication prerequisite and limited read-only impact.
RemediationAI
No vendor-released patch identified at time of analysis; JeecgBoot 3.9.5 remains the latest confirmed affected release, so administrators should track the upstream project and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-airag-api-getchatvariable-username-parameter) for a fixed version and upgrade as soon as one is published. Until then, the most direct mitigation is to apply a code-level authorization check in AiragBaseApiController that rejects requests where the supplied username does not match the authenticated subject (for example, comparing the parameter against the current Shiro/Spring Security principal before performing the Redis lookup) and to validate that the requested appId belongs to the caller; this is a small, low-risk change but requires rebuilding and redeploying the AI chat module. If modifying the application is not feasible and AIRAG is not in active use, disable the AIRAG module entirely or block the /airag/api/getChatVariable path (and, more broadly, the /airag/api/* namespace) at the reverse proxy, API gateway, or WAF - the trade-off is loss of AI chat functionality for all users. If AIRAG must remain available, restrict the endpoint to trusted internal networks or specific roles and add logging/alerting on POST requests to /airag/api/getChatVariable, recognizing that these are compensating controls that reduce but do not eliminate exposure for any authenticated user who retains access. Ensure Redis holding chat-variable data is not directly reachable from untrusted networks, since the same values are readable there, and rotate or purge stored chat variables if unauthorized reads are suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-639 authorization bypass through user-controlled key, also known as an insecure direct object reference (IDOR), in the AIRAG (AI retrieval-augmented generation) module of JeecgBoot, a Java/Spring Boot low-code development platform. The vulnerable controller, AiragBaseApiController (jeecg-boot-module-airag, source referenced at lines 47-54 of the file in the JeecgBoot repository), exposes a POST endpoint /airag/api/getChatVariable that accepts an appId, a username, and a variable name and returns the corresponding stored chat memory value. Because the lookup key is taken from the request body rather than being derived from the authenticated subject, any authenticated user can supply a different victim's username and retrieve that user's AI chat variables; the underlying values are held in Redis as the chat-memory backing store, so the endpoint effectively acts as an unvalidated read proxy into that datastore. The CPE string cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates the flaw is tracked against all versions of the JeecgBoot product rather than a single build, with 3.9.5 being the latest confirmed affected release. No injection, deserialization, or memory-safety primitive is involved: the root cause is purely the absence of an ownership check binding the requested username to the current session, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network reachability but a low-confidentiality, no-integrity, no-availability impact.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity but requires an authenticated account (PR:L); only limited confidentiality disclosure of other users' chat variables, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB