Missing Authorization in JeecgBoot Allows Users to Modify AI Prompt Templates
CVE-2026-108665

5.3MEDIUM

Key Information:

Vendor

Jeecgboot

Status
Jeecgboot
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-108665?

JeecgBoot version 3.9.5 is affected by a missing authorization vulnerability within the AiragPromptsController's edit handler. This flaw permits any authenticated user to send PUT or POST requests to the /airag/prompts/edit endpoint, enabling them to alter AI prompt templates and their related settings created by other users, including administrators. This can lead to unauthorized modifications and potential misuse of prompt configurations, posing a significant risk to the integrity of the system.

Affected Version(s)

JeecgBoot 0 <= 3.9.5

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe19...
technical-description
https://www.vulncheck.com/advisories/jeecgboot-through-3....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.