CVE-2026-108877: JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list endpoint and logically delete any user's prompt template, making it unavailable to all users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need to own the target prompt template.
What does an attacker need to delete another user's prompt template?
The attacker needs an authenticated account and a prompt template ID. Template IDs can be obtained from the unguarded GET /airag/prompts/list endpoint.
What is the impact of successful exploitation?
An attacker can logically delete any user's AI prompt template. The deleted template becomes unavailable to all users, affecting integrity and availability.
How can defenders determine whether their deployment is affected?
Deployments of JeecgBoot through version 3.9.5 are affected according to the available information. Review whether authenticated low-privileged accounts can access GET /airag/prompts/list and submit DELETE requests to /airag/prompts/delete for prompt IDs they do not own.