CVE-2026-108606 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot installations, particularly those with low-privileged user accounts, should assess exposure and prioritize patching or mitigating this vulnerability to prevent unauthorized deletion of OCR records.

Why it matters

CVE-2026-108606 is a medium-severity vulnerability in JeecgBoot that allows authenticated users to delete OCR records without authorization. Defenders should prioritize patching and monitoring to prevent disruption and data loss.

• Authenticated users can delete OCR records without proper authorization, potentially disrupting shared OCR prompt records.
• Low-privileged attackers can enumerate and delete records using the unguarded GET /airag/ocr/list endpoint.
• Defenders need to verify and patch affected installations to prevent exploitation.
• Monitoring for unauthorized deletions is necessary to detect potential attacks.

Technical summary

The CVE-2026-108606 vulnerability is caused by a missing authorization check in the AiOcrController deleteById handler of JeecgBoot versions up to 3.9.5. This handler allows any authenticated user to delete OCR records. An attacker can enumerate record IDs using the unguarded GET /airag/ocr/list endpoint and then delete shared OCR prompt records stored in Redis. Affected product deployments should be verified, and defenders should restrict access to the AiOcrController deleteById handler and monitor for unauthorized deletion of OCR records to prevent disruption and data loss.

Defensive priority

Defenders should prioritize verifying and patching affected JeecgBoot installations, restricting access to the AiOcrController deleteById handler, and monitoring for unauthorized deletion of OCR records.

Recommended defensive actions

• Verify and patch affected JeecgBoot installations to restrict access to the AiOcrController deleteById handler.
• Monitor for unauthorized deletion of OCR records.
• Restrict access to the GET /airag/ocr/list endpoint to prevent record ID enumeration.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references indicate a missing authorization vulnerability in JeecgBoot's AiOcrController deleteById handler. The vulnerability allows authenticated users to delete OCR records without proper authorization. Record IDs can be obtained from the unguarded GET /airag/ocr/list endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.