CVE-2026-108614 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the AiragExtDataController component, affecting the exportXls handler which is designed to generate Excel workbooks from internal data stores. The core technical deficiency lies in the absence of sufficient authorization checks for this specific endpoint. While the application correctly requires authentication to access most administrative or sensitive features, it fails to verify whether the authenticated user possesses the necessary privileges to view or export AI evaluator definitions and test-tracking records belonging to other users. This oversight allows any valid account holder, regardless of their role or permission level within the system, to bypass intended restrictions and retrieve data that should be isolated per tenant or user context.
From an operational perspective, this vulnerability enables low-privileged attackers to exfiltrate sensitive information by simply issuing a GET request to the /airag/extData/exportXls endpoint. The attacker does not need to exploit complex injection techniques or reverse-engineer API logic; they merely need valid credentials for any existing user account within the JeecgBoot environment. Upon successful authentication, the server processes the export request and returns an Excel file containing comprehensive data about AI evaluators. This includes detailed definitions of how various AI models are configured to evaluate inputs, as well as historical test-tracking records that may reveal performance metrics, error logs, or specific use cases for these AI systems. The ability to download this data in a structured format like Excel significantly lowers the barrier for attackers to parse and analyze the information, facilitating further reconnaissance or exploitation of downstream systems dependent on these AI configurations.
The impact of this vulnerability extends beyond simple data leakage. By accessing airag_ext_data evaluator definitions, an attacker gains insight into the logic and parameters governing artificial intelligence evaluations within the organization. This knowledge can be leveraged to craft more sophisticated attacks against the AI models themselves or to identify weaknesses in the evaluation criteria that could lead to model manipulation or bias exploitation. Furthermore, test-tracking records often contain metadata about user interactions with the system, potentially revealing patterns of usage, sensitive business processes being evaluated by AI, and internal operational workflows. In environments where JeecgBoot is used for multi-tenant applications, this lack of proper isolation means that a compromise of one low-level account could lead to a breach affecting data integrity across multiple tenants or departments, violating principles of least privilege and data segregation mandated by standards such as OWASP ASVS Level 2 requirements for access control.
To mitigate this vulnerability, immediate remediation should focus on implementing robust authorization checks within the AiragExtDataController.exportXls method. Developers must ensure that before any export operation is initiated, the system verifies not only that the user is authenticated but also that they have explicit administrative rights or specific permissions tied to the AI evaluator data module. This can be achieved by integrating role-based access control (RBAC) checks directly into the controller logic, ensuring that only users with designated roles such as Admin or Data Analyst are permitted to execute export functions. Additionally, implementing tenant isolation checks is crucial if the application supports multi-tenancy, ensuring that users can only access data associated with their own organization or project scope. Beyond code fixes, organizations should conduct a thorough audit of other endpoints in the JeecgBoot framework for similar missing authorization flaws, as this pattern often indicates broader gaps in security design. Regular penetration testing and static application security testing (SAST) focused on access control logic can help identify such issues before they are exploited in production environments.