CVE-2026-108665 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the AiragPromptsController component, specifically affecting the edit handler for AI prompt templates. This flaw is classified as an Insecure Direct Object Reference or more broadly as Broken Access Control, which aligns with CWE-264 (Incorrect Assumption of Exclusive Ownership) and CWE-918 (Server-Side Request Forgery if used to manipulate internal services). The core technical issue stems from the application's failure to verify whether the authenticated user initiating the request possesses administrative privileges or ownership rights over the specific resource being modified. Instead of enforcing role-based access control checks that restrict modification capabilities to authorized administrators, the system accepts PUT and POST requests directed at the /airag/prompts/edit endpoint regardless of the caller's privilege level. This architectural oversight allows any validly authenticated user, even those with low-privileged roles such as standard end-users or guests, to interact directly with administrative functions intended for system configuration.
From an operational perspective, this vulnerability enables attackers to overwrite prompt text and model parameters that were originally created by administrators or other users. In the context of AI-driven applications like JeecgBoot's Airag module, prompts serve as critical instructions that define how the artificial intelligence models behave, respond, and process data. By manipulating these templates, an attacker can fundamentally alter the logic and output of the AI system without needing to exploit a separate code execution flaw. This capability facilitates prompt injection attacks where malicious instructions are embedded into the template, potentially causing the model to leak sensitive information, bypass safety filters, or generate harmful content. Furthermore, since these changes persist in the backend configuration, they affect all subsequent interactions with that specific prompt template, creating a persistent threat vector across multiple user sessions and applications relying on the compromised AI service.
The impact of this vulnerability extends beyond simple defacement or misconfiguration; it compromises the integrity and trustworthiness of the entire artificial intelligence pipeline. Attackers can use this access to perform data poisoning by injecting biased or incorrect information into training-like prompts, which may degrade model performance over time if retrained on corrupted templates. Additionally, in multi-tenant environments where different organizations share the same JeecgBoot instance, a low-privileged user from one tenant could potentially modify prompts used by another tenant's administrators, leading to cross-tenant data leakage or service disruption. This scenario is particularly dangerous because it bypasses traditional perimeter defenses and identity verification steps that rely on high-level authentication rather than granular authorization checks for specific business logic operations.
To mitigate this vulnerability, developers must implement strict role-based access control (RBAC) policies within the AiragPromptsController edit handler. The application should explicitly verify that the authenticated user holds an administrative role or is the designated owner of the prompt template before allowing any modification requests to proceed. Input validation and sanitization should also be enforced to prevent injection attacks through the modified fields, although this does not replace the need for proper authorization checks. Upgrading to a patched version of JeecgBoot that addresses these access control flaws is essential. In the interim, network-level controls such as Web Application Firewalls can be configured to monitor and restrict unusual patterns of PUT or POST requests targeting prompt management endpoints from non-administrator accounts. Regular security audits focusing on API endpoint authorization logic are recommended to prevent similar broken access control issues in other modules of the framework.