Vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to read document text chunks from unauthorized knowledge bases.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Apache Software Foundation

Product

Shiro

CVSS

4.3

Exposure class

Identity

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108669 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling…

   CVSS 4.3 CVE-2026-108680
2. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any…

   CVSS 4.3 CVE-2026-108679
3. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated…

   CVSS 4.3 CVE-2026-108678
4. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users…

   CVSS 6.5 CVE-2026-108677
5. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows…

   CVSS 4.3 CVE-2026-108676
6. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108675
7. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108674
8. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated…

   CVSS 4.3 CVE-2026-108673
9. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows…

   CVSS 4.3 CVE-2026-108672
10. 8
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because…

    CVSS 6.5 CVE-2026-108671 Anthropic
11. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any…

    CVSS 4.3 CVE-2026-108670
12. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any…

    CVSS 5.4 CVE-2026-108668
13. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt…

    CVSS 4.3 CVE-2026-108667
14. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any…

    CVSS 5.4 CVE-2026-108666
15. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user…

    CVSS 4.3 CVE-2026-108665
16. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…

    CVSS 4.3 CVE-2026-108664
17. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated…

    CVSS 4.3 CVE-2026-108663
18. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant…

    CVSS 5.4 CVE-2026-108662
19. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…

    CVSS 6.5 CVE-2026-108661
20. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT…

    CVSS 4.3 CVE-2026-108660