CVE-2026-108610 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework, specifically affecting versions up through 3.9.5, and centers on a critical missing authorization vulnerability in the AigcWordTemplateController edit handler. This architectural weakness allows any authenticated user to execute modifications against word templates without verifying whether they possess the necessary permissions or ownership rights for those specific resources. The core technical issue is an insecure direct object reference combined with a failure to enforce proper access controls, enabling low-privileged attackers to manipulate shared assets that are intended for broader organizational use rather than individual customization.
From a technical perspective, the vulnerability exploits the lack of server-side validation on PUT and POST requests directed at the /airag/word/edit endpoint. When an authenticated user submits these HTTP methods, the application processes the request without checking if the requesting entity is authorized to alter the target template ID or name provided in the payload. This absence of role-based access control checks means that a standard user can effectively hijack administrative functions by targeting templates managed by other users or system-wide configurations. The attacker simply needs valid credentials and knowledge of the endpoint structure, which are often predictable in such frameworks, to craft malicious requests that overwrite critical document generation assets.
The operational impact of this vulnerability is significant for organizations relying on JeecgBoot for automated document processing workflows. By overwriting shared templates, attackers can disrupt business continuity by corrupting or replacing essential formats used for invoices, contracts, reports, and other official documents. This manipulation may lead to the distribution of incorrect information, financial discrepancies due to altered template structures, or complete failure in downstream processes that depend on these specific document layouts. Furthermore, if the templates contain logic for data extraction or formatting sensitive fields, an attacker could potentially inject malicious content or exfiltrate data through manipulated output formats, compromising both integrity and confidentiality within the application ecosystem.
This vulnerability aligns with CWE-862, which describes missing authorization vulnerabilities where a user is allowed to access resources they should not have permission for. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it leverages existing credentials to perform unauthorized actions, and potentially T1499, Endpoint Denial of Service, if the goal is to disrupt operations by corrupting critical templates. To mitigate this risk, developers must implement strict server-side authorization checks within the AigcWordTemplateController edit handler to verify that the authenticated user has explicit permission to modify the specific template being targeted. Additionally, implementing object-level access control policies and auditing mechanisms will help detect and prevent unauthorized modifications. Upgrading to a patched version of JeecgBoot where this flaw is resolved is essential for restoring secure operational integrity in affected environments.