CVE-2026-108612 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw resides within the AigcWordTemplateController component, which is responsible for managing AI-generated word templates. The core technical issue stems from an insufficient validation of user privileges during batch deletion operations. When a request is processed by the deleteBatch handler, the system fails to verify whether the authenticated user possesses administrative rights or ownership over the specific resources being targeted. Instead of enforcing strict object-level access controls that restrict modifications to only those items explicitly owned by the requesting user, the application relies on the presence of valid authentication credentials alone. This architectural oversight allows any logged-in user, regardless of their role or permission level within the application hierarchy, to execute destructive actions against shared resources.
From an operational perspective, this vulnerability enables low-privileged authenticated users to permanently delete word templates stored in a shared library. The attack vector involves sending an HTTP DELETE request to the endpoint /airag/word/deleteBatch with comma-separated identifiers corresponding to target template IDs. Because the backend logic does not cross-reference these IDs against the user's authorized resource list, it proceeds with the deletion without raising an error or denying access. This lack of authorization checks effectively bypasses intended security boundaries, turning a standard administrative function into a tool for data destruction available to all authenticated participants in the system. The impact is severe as it compromises the integrity and availability of critical business assets, potentially leading to significant operational disruptions if essential templates are removed by unauthorized actors.
This type of vulnerability aligns with MITRE ATT&CK technique T1485, specifically Data Destruction, where an adversary modifies or deletes data to disrupt operations or cause harm. Furthermore, it reflects common patterns found in CWE-269 regarding Improper Privilege Management and CWE-732 concerning Incorrect Permission Assignment for Critical Resources. The absence of proper role-based access control (RBAC) checks at the controller level indicates a broader systemic issue where business logic is not adequately separated from security enforcement mechanisms. Such oversights are particularly dangerous in multi-tenant or collaborative environments where shared libraries are common, as they allow lateral movement and escalation of impact by any user with basic account privileges.
To mitigate this vulnerability, developers must implement robust authorization checks within the deleteBatch handler before processing deletion requests. This involves verifying that each template ID provided in the request belongs to a resource owned by or explicitly accessible to the authenticated user making the request. Implementing object-level security policies ensures that users can only modify data they are permitted to access. Additionally, adopting principle of least privilege across all API endpoints and conducting regular code reviews focused on access control logic can prevent similar flaws. Utilizing established frameworks for authorization management and integrating automated static analysis tools capable of detecting missing permission checks will further strengthen the application's security posture against such unauthorized actions.