CVE-2026-108612: JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker only needs network access to the affected JeecgBoot instance and valid credentials; no user interaction is required.
What access or data does an attacker need to perform the deletion?
The attacker needs to send a DELETE request to /airag/word/deleteBatch and supply one or more target template IDs as comma-separated values. The affected handler does not enforce authorization for deleting templates in the shared library.
What is the impact of successful exploitation?
An attacker can permanently delete arbitrary word templates from the shared library. The reported impact is limited to integrity and availability; no confidentiality impact is stated.
How can I determine whether my deployment is affected?
Deployments of JeecgBoot through version 3.9.5 are affected if the Airag word-template deleteBatch endpoint is present at /airag/word/deleteBatch. Review access logs for DELETE requests to that path, especially requests with comma-separated id values from low-privileged accounts.