CVE-2026-108615: JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it if they can send DELETE requests to the affected endpoint. The attacker does not need ownership of the targeted record or access to its tenant.
What does an attacker need to provide to delete another user's record?
The attacker needs to send a DELETE request to /airag/extData/delete with an id parameter for the target record. The handler does not enforce owner or tenant checks for that deletion.
What data or functionality is affected?
The issue affects AI evaluator records and test-tracking records handled by the AiragExtDataController delete operation. Successful exploitation deletes records, affecting integrity and availability rather than confidentiality.