CVE-2026-108666: JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch to remove templates created by administrators or other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The impact is deletion of AI prompt templates created by administrators or other users.
What information does an attacker need to delete another user's prompt templates?
The attacker needs valid prompt IDs. These IDs can be obtained through the unguarded list endpoint and supplied to the deleteBatch handler.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 are affected if they expose the AiragPromptsController deleteBatch handler at /airag/prompts/deleteBatch. A practical verification is whether a low-privileged authenticated account can list prompt IDs and delete templates it did not create.