CVE-2026-108607 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot instances, especially those using AI video generation features, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the existence of affected product deployments and implement necessary controls to prevent unauthorized deletion of video records.

Why it matters

CVE-2026-108607 is a medium-severity vulnerability in JeecgBoot that allows authenticated users to delete other users' AI video generation records. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where unauthorized deletion of video records could have operational impacts.

• Potential unauthorized deletion of video records
• Possible disruption of AI video generation services
• Need for verification of vulnerability existence and remediation
• Potential impact on Redis-stored video history entries

Technical summary

The vulnerability allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request. This insecure direct object reference vulnerability in JeecgBoot through 3.9.5 can lead to potential unauthorized deletion of video records and possible disruption of AI video generation services.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where unauthorized deletion of video records could have operational impacts.

Recommended defensive actions

• Verify the vulnerability exists in your JeecgBoot instance
• Restrict access to DELETE /airag/video/deleteVideoRecord
• Monitor for unauthorized deletion of video records
• Implement additional authentication and authorization checks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information. Defenders should verify the existence of affected product deployments and assess potential exposure. The vulnerability allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listBy

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.