CVE-2026-108611 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework, specifically affecting versions up through 3.9.5, and centers on a critical missing authorization check in the AigcWordTemplateController component. This vulnerability manifests as an insecure direct object reference or broken access control issue where the application fails to verify whether the authenticated user initiating the request has the appropriate permissions to perform actions on specific resources. The core technical flaw lies in the delete handler for word templates, which processes incoming DELETE requests without adequately validating that the requesting entity owns the target resource or possesses administrative privileges required for such destructive operations. This oversight allows any validly authenticated user, regardless of their role or privilege level within the system, to interact with endpoints intended for privileged management tasks.
From a technical perspective, an attacker can exploit this vulnerability by crafting and sending HTTP DELETE requests directly to the /airag/word/delete endpoint while supplying a specific id parameter that corresponds to any word template stored in the shared library. Because the server does not enforce ownership checks or role-based access controls before executing the deletion logic, it blindly processes the request and permanently removes the specified template from the database. This behavior indicates a fundamental failure in implementing proper object-level security policies, where the application assumes that authentication alone is sufficient to authorize all actions on accessible endpoints, ignoring the necessity of granular authorization checks for sensitive data manipulation operations.
The operational impact of this vulnerability is significant, particularly in environments where JeecgBoot is used as a low-code development platform managing shared assets among multiple teams or users. The ability for any authenticated user to delete word templates from the shared library can lead to substantial service disruption and loss of critical business artifacts. If these templates are essential for generating documents across various departments, their unauthorized removal can halt workflows that depend on them, causing operational delays and requiring time-consuming restoration efforts from backups if available. Furthermore, this lack of integrity control undermines trust in the platform's data management capabilities and may violate compliance requirements related to data integrity and availability within regulated industries.
This vulnerability aligns with Common Weakness Enumeration category CWE-269, which describes Improper Privilege Control, as it involves a user exercising privileges beyond their assigned role without proper verification. It also maps directly to the MITRE ATT&CK technique T1078, specifically Valid Accounts under the Initial Access or Persistence tactics depending on how the attacker leverages the stolen credentials, and more precisely relates to resource manipulation behaviors found in lateral movement or impact phases where an adversary modifies system configurations or data to achieve their objectives. The absence of authorization checks represents a classic example of broken access control that remains prevalent in web applications due to inconsistent implementation patterns across different controllers and endpoints within large codebases.
To mitigate this vulnerability, developers must immediately implement robust role-based access control mechanisms for the AigcWordTemplateController delete handler. This involves verifying not only that the user is authenticated but also confirming that they hold a specific administrative role or are the explicit owner of the template identified by the provided id parameter before allowing the deletion operation to proceed. Additionally, implementing an audit logging mechanism to track all deletion attempts and successes can aid in detecting potential abuse patterns post-deployment. Upgrading to a patched version of JeecgBoot that addresses this access control flaw is essential for long-term security posture improvement. Until such patches are applied or custom fixes are deployed, restricting network-level access to the affected endpoints via firewall rules or API gateways may provide temporary relief against external exploitation attempts by unauthenticated users, though it will not fully mitigate risks from compromised internal accounts with low privileges.