CVE-2026-108605 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's artificial intelligence and optical character recognition subsystems. Specifically, the flaw resides in the AiOcrController updateById handler, which processes requests intended for updating individual OCR template records. In a properly secured system, such operations should be strictly bound to the specific resource being modified or require administrative privileges if global changes are involved. However, due to missing authorization checks, this endpoint does not verify whether the authenticated user has sufficient permissions to alter shared configuration data. This oversight allows any authenticated user, regardless of their role or privilege level within the application, to execute write operations against endpoints that should be restricted to administrators or specific service accounts.
The technical exploitation vector involves sending HTTP PUT requests to the /airag/ocr/edit endpoint with carefully crafted payloads designed to overwrite critical configuration parameters stored in a shared Redis key named airag:ocr. This Redis key serves as a central repository for global OCR templates and associated Large Language Model prompts used by the application's AI features. By manipulating this shared state, an attacker can inject malicious or malformed LLM prompts into the system-wide configuration. Because these settings are applied globally rather than per-user, the impact of such tampering is not limited to the attacker’s own session but extends to every user interacting with the OCR functionality within the JeecgBoot environment.
The operational impact of this vulnerability is severe and multifaceted. First, it leads to data integrity issues as legitimate OCR templates are corrupted or replaced by unauthorized content. This corruption can result in inaccurate text extraction from images, causing downstream business logic failures that rely on precise data parsing. Second, the ability to modify LLM prompts introduces significant security risks beyond simple functional disruption. Malicious actors could craft prompts designed to induce hallucinations, leak sensitive information processed during OCR tasks, or trigger unintended behaviors within the connected AI models. This effectively turns a standard document processing feature into a potential vector for prompt injection attacks and data exfiltration, compromising both confidentiality and availability of services provided by the application.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it allows users to perform actions that exceed their assigned privileges. It also relates closely to CWE-862 Missing Authorization, where the software does not properly verify access control before allowing an action on a protected resource. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to gain unauthorized influence over system configuration and data integrity. The exploitation path resembles aspects of T1562 Impair Defenses if the corrupted prompts are used to disable or confuse monitoring systems, though its primary impact is on availability and data quality via T1499 Endpoint Denial of Service through resource exhaustion or logical corruption.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most urgent step is for administrators to apply the vendor-provided patch that updates JeecgBoot to a version greater than 3.9.5, which includes fixes for this authorization bypass. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to restrict access to the /airag/ocr/edit endpoint exclusively from trusted administrative IP addresses or internal service accounts. Additionally, implementing strict input validation and output encoding on all parameters passed to Redis keys can help mitigate some risks associated with prompt injection. Long-term solutions should involve refactoring the AiOcrController to enforce role-based access control checks before any write operations are executed against shared configuration stores, ensuring that only authorized personnel can modify global system settings. Regular security audits of API endpoints and automated testing for broken object level authorization flaws are also recommended to prevent similar vulnerabilities in future development cycles.