CVE-2026-108672: JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker only needs to submit another user's ID in the userId parameter to the affected handler.
What information can be exposed?
An attacker can retrieve another user's AI video generation history. Exposed data includes prompts, task IDs, video URLs, and cover URLs.
How can we determine whether an account's records may have been exposed?
Review requests to /airag/video/listByUser for cases where the supplied userId does not belong to the authenticated requester. Such mismatches indicate attempted or successful unauthorized access to another user's video-generation records.