CVE-2026-108605: JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit the affected endpoint. No user interaction is required.
What access or request is needed to exploit it?
An attacker needs valid authentication and network access to send a PUT request to /airag/ocr/edit. The vulnerable updateById handler does not enforce authorization for modifying the global OCR templates.
What is the practical impact of successful exploitation?
An attacker can overwrite LLM prompts stored in the shared airag:ocr Redis key. This can corrupt OCR results for all users of the affected deployment.
How can teams determine whether they are affected?
Deployments running JeecgBoot through version 3.9.5 are affected according to the available information. Review whether authenticated low-privileged users can issue PUT requests to /airag/ocr/edit and whether the shared airag:ocr Redis key has unexpected prompt content.