CVE-2026-108672 jeecgboot CVE debrief

Who should care

Defenders responsible for securing JeecgBoot installations, particularly those using versions up to 3.9.5, should assess exposure and verify access controls to prevent unauthorized access to AI video generation history.

Why it matters

CVE-2026-108672 is an authorization bypass vulnerability in JeecgBoot through 3.9.5, allowing authenticated users to read other users' AI video generation history. Defenders should prioritize verifying and restricting access to the VideoGenerationController's getVideoRecords handler.

• Authenticated users can access sensitive information belonging to other users
• Low-privileged attackers can exploit this vulnerability to retrieve AI video generation history
• Defenders need to verify and restrict access to the VideoGenerationController's getVideoRecords handler

Technical summary

The getVideoRecords handler of VideoGenerationController in JeecgBoot through 3.9.5 is vulnerable to authorization bypass, allowing authenticated users to read other users' AI video generation history by supplying another user ID. This vulnerability can be exploited by low-privileged attackers to retrieve AI video generation history, including prompts, task IDs, video URLs, and cover URLs. Defenders should prioritize verifying and restricting access to the VideoGenerationController's getVideoRecords handler, ensuring that users can only access their own video generation history.

Defensive priority

Defenders should prioritize verifying and restricting access to the VideoGenerationController's getVideoRecords handler, ensuring that users can only access their own video generation history.

Recommended defensive actions

• Verify and restrict access to the VideoGenerationController's getVideoRecords handler
• Ensure users can only access their own video generation history
• Monitor for suspicious activity related to AI video generation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the corpus lacks information on affected versions, exploitation, and remediation. Further verification is required from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.