CVE-2026-108611: JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need elevated authorization for the delete operation.
What does an attacker need to send?
The attacker needs to send a DELETE request to /airag/word/delete with an id parameter identifying a word template. Successful exploitation permanently removes the selected template from the shared library.
Are unauthenticated attackers affected by this authorization flaw?
The available information identifies exploitation as requiring an authenticated user. It does not indicate that unauthenticated requests can delete templates.