CVE-2026-108609: JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
JeecgBoot deployments through 3.9.5 are affected where authenticated users can access the AI voice history endpoint. Any user whose voice-generation history is stored by the application may have that history exposed to another authenticated user.
What does an attacker need to exploit it?
The attacker needs a valid authenticated account and the target user's userId. They can supply that identifier to GET /airag/voice/listByUser to retrieve the target's voice-generation history.
What information can be disclosed?
The exposed history can include submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.