CVE-2026-108614 jeecgboot CVE debrief

Who should care

Defenders responsible for systems using JeecgBoot, especially those with low-privileged user access to the affected functionality, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108614 is a missing authorization vulnerability in JeecgBoot through 3.9.5 that allows low-privileged attackers to export AI evaluator data. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected functionality.

• Potential unauthorized data disclosure through exploitation of the missing authorization vulnerability.
• Possible misuse of the export functionality by low-privileged users to access sensitive data.
• Need for verification of the affected versions and systems to ensure proper remediation.
• Potential impact on data integrity and confidentiality if the vulnerability is exploited.

Technical summary

The vulnerability exists in the AiragExtDataController exportXls handler of JeecgBoot through 3.9.5. This handler allows any authenticated user to export AI evaluator data without proper authorization. Low-privileged attackers can exploit this by requesting /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook. Defenders should assess exposure, especially in systems where low-privileged users have access to the affected functionality, and prioritize remediation.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected functionality.

Recommended defensive actions

• Verify the version of JeecgBoot being used and assess if it is within the affected range.
• Restrict access to the /airag/extData/exportXls endpoint to authorized users only.
• Monitor for any suspicious requests to the affected endpoint.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the exact scope of affected systems and versions requires further verification from the official sources. Defenders should verify JeecgBoot versions, assess system configurations, and confirm if low-privileged users have access to the AiragExtDataController exportXls handler.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.