CVE-2026-108606: JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit the missing authorization check. The attacker needs network access to the affected application and valid credentials.
How can an attacker identify records to delete?
The unguarded GET /airag/ocr/list endpoint exposes OCR record IDs. An authenticated attacker can use those IDs with /airag/ocr/deleteById and repeat the process to delete shared OCR prompt records.
What is the practical impact?
An attacker can delete OCR records stored in Redis, affecting the integrity and availability of shared OCR prompt data. The provided information does not indicate confidentiality impact.
How can administrators check for exposure or suspected exploitation?
Verify whether the deployment is JeecgBoot version 3.9.5 or earlier and exposes the /airag/ocr/list and /airag/ocr/deleteById handlers. Review application or access logs for low-privileged accounts making repeated list requests followed by deleteById requests, and check for unexpected loss of OCR records in Redis.