CVE-2026-108670 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the AiragPromptsController component. Specifically, the promptExperiment handler lacks proper authorization checks to verify whether the authenticated user initiating the request has ownership or sufficient privileges for the specific resources being accessed. This architectural flaw allows any logged-in user with low-privileged credentials to bypass intended security boundaries and interact directly with internal application logic that should be restricted to authorized personnel or resource owners. The absence of these checks means that the system trusts client-supplied identifiers without validating their association with the current session, creating a straightforward path for unauthorized actions.
From a technical perspective, this flaw enables an attacker to supply arbitrary prompt template and dataset identifiers belonging to other users within the same instance. By manipulating these input parameters, the attacker can trigger large language model evaluation runs on behalf of victims or against victim-owned resources. The operational consequence is twofold: first, the system writes result rows into the airag_ext_data table associated with the targeted datasets, potentially corrupting data integrity or consuming computational resources through unauthorized AI processing tasks. Second, and more critically, the attacker can alter the status of these datasets, which may disrupt ongoing workflows, cause application errors for legitimate users, or lead to inconsistent states within the database that are difficult to reconcile without manual intervention.
This vulnerability aligns with CWE-284, Improper Access Control, as it involves a failure to enforce proper authorization policies before executing sensitive operations. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving unauthorized access and potential data manipulation or impact through resource abuse. The ability to modify dataset statuses also touches upon CWE-352, Cross-Site Request Forgery (CSRF), if the vulnerability can be exploited via crafted requests from a different origin, although the primary classification remains an authorization bypass due to the lack of server-side validation on resource ownership.
The impact extends beyond simple data corruption; it affects the availability and integrity of AI-driven features within the JeecgBoot platform. Legitimate users may find their datasets locked or marked with incorrect statuses, preventing them from completing their work. Additionally, the unauthorized execution of large language model evaluations can lead to significant resource exhaustion, increasing infrastructure costs and potentially causing denial-of-service conditions for other tenants in a multi-tenant deployment scenario. The write operations into airag_ext_data also pose a risk if those results are subsequently displayed or used by other parts of the application, as they may contain maliciously crafted content injected through manipulated prompt templates.
To mitigate this vulnerability, developers must implement strict authorization checks within the promptExperiment handler to verify that the authenticated user is the owner of the specified prompt template and dataset before allowing any operations to proceed. This involves querying the database or session context to confirm resource ownership prior to triggering AI evaluation runs. Additionally, implementing role-based access control (RBAC) policies can restrict who has permission to execute experiments on shared datasets. Input validation should also be enforced to ensure that supplied identifiers are valid and belong to accessible resources, although this is secondary to proper authorization logic. Upgrading to a patched version of JeecgBoot where these checks have been implemented is the most effective remediation strategy for existing deployments.