CVE-2026-108616 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot deployments should assess their exposure and prioritize remediation. Low-privileged users with access to the affected API endpoint are at risk of being able to delete other users' evaluator and test-tracking records.

Why it matters

CVE-2026-108616 is a missing authorization vulnerability in JeecgBoot through 3.9.5 that allows low-privileged users to delete AI evaluator records. Defenders should verify and remediate this vulnerability, especially in systems where low-privileged users have access to the affected API endpoint. The exact scope of affected versions and potential impact requires further verification from official sources.

• Low-privileged users can delete AI evaluator and test-tracking records belonging to other users.
• Potential data loss or corruption due to unauthorized deletion of records.
• Possible disruption of AI evaluation and testing processes.
• Verification of affected versions and remediation status is required.

Technical summary

The vulnerability exists in the AiragExtDataController deleteBatch handler of JeecgBoot through 3.9.5. This handler fails to perform necessary authorization checks, allowing any authenticated user to delete AI evaluator records by sending a DELETE request with comma-separated IDs to the /airag/extData/deleteBatch endpoint. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, effectively deleting other users' evaluator and test-tracking records. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected API endpoint.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where low-privileged users have access to the affected API endpoint.

Recommended defensive actions

• Verify the version of JeecgBoot in use and check if it is vulnerable (3.9.5 or earlier).
• Restrict access to the DELETE /airag/extData/deleteBatch endpoint to authorized users only.
• Implement additional monitoring to detect and respond to potential exploitation attempts.
• Consider applying patches or updates provided by the vendor, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in JeecgBoot through 3.9.5. The vulnerability exists in the AiragExtDataController deleteBatch handler, allowing any authenticated user to delete AI evaluator records. However, the exact scope of affected versions and potential impact requires further verification from official sources. Defenders should verify the version of JeecgBoot in use, check if it is vulnerable (3.9.5 or earlier), and consider applying patches or updates provided by the vendor, if available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.