CVE-2026-108668: JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need administrative privileges.
What does an attacker need to send?
The attacker needs to send DELETE requests to the deleteRecycleBin handler with prompt template IDs. Templates in the recycle bin belonging to administrators or other users can be permanently removed.
What is the impact on affected systems?
The vulnerability affects integrity and availability of AI prompt templates: an attacker can purge recycled templates so they cannot be recovered through the recycle bin.