CVE-2026-108877: JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need to own the target prompt template.

Q: What does an attacker need to delete another user's prompt template?

The attacker needs an authenticated account and a prompt template ID. Template IDs can be obtained from the unguarded GET /airag/prompts/list endpoint.

Q: What is the impact of successful exploitation?

An attacker can logically delete any user's AI prompt template. The deleted template becomes unavailable to all users, affecting integrity and availability.

Q: How can defenders determine whether their deployment is affected?

Deployments of JeecgBoot through version 3.9.5 are affected according to the available information. Review whether authenticated low-privileged accounts can access GET /airag/prompts/list and submit DELETE requests to /airag/prompts/delete for prompt IDs they do not own.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list endpoint and logically delete any user's prompt template, making it unavailable to all users.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged user, can exploit it. The attacker does not need to own the target prompt template.

What does an attacker need to delete another user's prompt template?

The attacker needs an authenticated account and a prompt template ID. Template IDs can be obtained from the unguarded GET /airag/prompts/list endpoint.

What is the impact of successful exploitation?

An attacker can logically delete any user's AI prompt template. The deleted template becomes unavailable to all users, affecting integrity and availability.

How can defenders determine whether their deployment is affected?

Deployments of JeecgBoot through version 3.9.5 are affected according to the available information. Review whether authenticated low-privileged accounts can access GET /airag/prompts/list and submit DELETE requests to /airag/prompts/delete for prompt IDs they do not own.

CVE-2026-108877: JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to delete another user's prompt template?

What is the impact of successful exploitation?

How can defenders determine whether their deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to delete another user's prompt template?

What is the impact of successful exploitation?

How can defenders determine whether their deployment is affected?