CVE-2026-108608: JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user can exploit it if they can access the affected AI voice endpoints. No elevated privileges or user interaction are required.
What does an attacker need to delete another user's voice records?
The attacker needs a victim's userId and the relevant voice record IDs. Record IDs can be obtained through the unchecked GET /airag/voice/listByUser endpoint, then submitted with an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord.
What is the impact of successful exploitation?
An attacker can delete other users' text-to-speech history entries stored in Redis. Deletion occurs one record per request; the provided information does not indicate disclosure of record contents or broader system compromise.
How can defenders determine whether their deployment is affected?
Deployments of JeecgBoot through 3.9.5 are identified as affected. Review access and application logs for requests to GET /airag/voice/listByUser and DELETE /airag/voice/deleteVoiceRecord, especially where the requesting user does not match the userId supplied to the deletion endpoint.