CVE-2026-108611 jeecgboot CVE debrief

Who should care

Defenders and administrators of systems using JeecgBoot through 3.9.5 should assess exposure and prioritize remediation, especially in environments where low-privileged users have access to the affected endpoint.

Why it matters

CVE-2026-108611 is a missing authorization vulnerability in JeecgBoot through 3.9.5 that allows low-privileged attackers to delete word templates. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected endpoint. The impact includes potential disruption of shared library content and lack of authorization checks. Verification of affected versions and remediation steps is required.

• Low-privileged users can delete word templates, potentially disrupting shared library content.
• Lack of authorization checks allows unauthorized template deletion.
• Verification of affected versions and remediation steps is required.

Technical summary

The vulnerability exists in the AigcWordTemplateController delete handler, allowing low-privileged attackers to send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library. This is a missing authorization vulnerability in JeecgBoot through 3.9.5. The affected product or component is JeecgBoot, and the vulnerability class is missing authorization. The likely operational impact includes disruption of shared library content and unauthorized template deletion.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected endpoint.

Recommended defensive actions

• Verify the affected versions of JeecgBoot and check if the system is vulnerable.
• Restrict access to the /airag/word/delete endpoint to authorized users only.
• Implement additional monitoring to detect and respond to potential exploitation attempts.
• Apply patches or updates provided by the vendor once available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the affected versions and remediation steps require verification from the official sources. The vulnerability has been publicly disclosed and may be exploited by low-privileged attackers. Defenders should verify the affected versions of JeecgBoot and check if the system is vulnerable. The official CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.