CVE-2026-108614: JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator definitions and test-tracking records as an Excel workbook.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit the vulnerable export handler. No additional privileges or user interaction are required.
What data can be exposed?
The export can download an Excel workbook containing every user's airag_ext_data evaluator definitions and test-tracking records.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through 3.9.5 are affected if the /airag/extData/exportXls endpoint is available. Review access and application logs for authenticated requests to that path, particularly exports initiated by low-privileged accounts.