CVE-2026-108607: JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can reach the affected AI video endpoints can exploit it. The attacker only needs a valid account; no user interaction is required.
How would an attacker identify records to delete?
The unchecked GET /airag/video/listByUser endpoint can expose record IDs. An attacker can use those IDs with arbitrary userId values in DELETE /airag/video/deleteVideoRecord to target another user's records.
What is the impact of successful exploitation?
An attacker can delete other users' AI video generation history entries stored in Redis. Deletion occurs one record per request; the provided data does not indicate disclosure of record contents or broader system compromise.
How can I check whether this has been exploited?
Review requests to GET /airag/video/listByUser and DELETE /airag/video/deleteVideoRecord, looking for users enumerating record IDs or DELETE requests where the supplied userId does not belong to the authenticated requester. Also investigate unexpected missing AI video history entries in Redis.