CVE-2026-108616: JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need to own the targeted records or belong to the same tenant.
What access and request are required to exploit it?
The attacker needs valid authenticated access and must send a DELETE request to /airag/extData/deleteBatch with comma-separated record IDs. No user interaction is required.
What data can be affected?
An attacker can delete other users' AI evaluator records and test-tracking records. The described impact is unauthorized deletion rather than disclosure or modification of record contents.
How can I determine whether records may have been targeted?
Review requests to /airag/extData/deleteBatch for DELETE operations, especially those containing comma-separated IDs. Investigate whether the requesting authenticated user was not the owner of, or was in a different tenant from, the deleted evaluator or test-tracking records.