Vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Anthropic

Product

Claude, AI / LLM tooling

CVSS

6.5

Exposure class

AI infrastructure

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108671 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling…

   CVSS 4.3 CVE-2026-108680
2. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any…

   CVSS 4.3 CVE-2026-108679
3. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated…

   CVSS 4.3 CVE-2026-108678
4. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users…

   CVSS 6.5 CVE-2026-108677
5. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows…

   CVSS 4.3 CVE-2026-108676
6. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108675
7. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108674
8. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated…

   CVSS 4.3 CVE-2026-108673
9. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows…

   CVSS 4.3 CVE-2026-108672
10. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any…

    CVSS 4.3 CVE-2026-108670
11. 15
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro…

    CVSS 4.3 CVE-2026-108669 Apache Software Foundation
12. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any…

    CVSS 5.4 CVE-2026-108668
13. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt…

    CVSS 4.3 CVE-2026-108667
14. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any…

    CVSS 5.4 CVE-2026-108666
15. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user…

    CVSS 4.3 CVE-2026-108665
16. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…

    CVSS 4.3 CVE-2026-108664
17. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated…

    CVSS 4.3 CVE-2026-108663
18. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant…

    CVSS 5.4 CVE-2026-108662
19. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…

    CVSS 6.5 CVE-2026-108661
20. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT…

    CVSS 4.3 CVE-2026-108660