CVE-2026-108672 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the VideoGenerationController component. Specifically, the getVideoRecords handler fails to enforce proper authorization checks when processing requests for AI video generation history. This flaw allows authenticated users with low privileges to bypass intended security restrictions by manipulating the userId parameter included in their API requests. Instead of retrieving only records associated with their own account, an attacker can supply a different user identifier to access sensitive data belonging to other individuals on the system.
From a technical perspective, this is a classic example of insecure direct object reference or broken access control where the application relies solely on client-supplied input for determining resource ownership without validating that the requesting entity has permission to view those specific resources. The absence of server-side validation ensures that any authenticated user can enumerate and retrieve private information simply by altering numerical identifiers in the request payload. This lack of proper object-level authorization creates a significant security gap, as the system does not verify whether the current session context matches the target resource owner before returning data.
The operational impact of this vulnerability is substantial due to the nature of the exposed data. The retrieved records contain AI video generation history which includes prompts used for content creation, task identifiers, direct URLs to generated videos, and cover image links. These elements constitute sensitive intellectual property and potentially personal information depending on the context in which the videos were created. Attackers can exploit this flaw to steal proprietary business logic embedded within prompts or access private media files shared between colleagues or clients. This leads directly to confidentiality breaches where unauthorized parties gain visibility into workflows, creative processes, and digital assets that should remain restricted to specific users.
This vulnerability aligns with CWE-284 Improper Access Control as it involves a failure to restrict information disclosure to authorized actors. Furthermore, the exploitation technique maps closely to MITRE ATT&CK techniques related to Collection of Application Data and potentially Credential Access if such data aids in further social engineering or account takeover attempts within an enterprise environment. The ability to scrape historical records also facilitates reconnaissance activities where attackers can map out user activity patterns and identify high-value targets based on their generation history.
To mitigate this risk, developers must implement strict server-side authorization checks that validate the relationship between the authenticated session's principal identity and the requested resource identifier. It is essential to ensure that API endpoints verify ownership or explicit permission before returning any data tied to a specific user record. Additionally, implementing role-based access control policies can help restrict sensitive operations to appropriate privilege levels. Regular security audits focusing on object-level authorization logic are recommended to prevent similar bypasses in other parts of the application framework. Updating to patched versions that address this controller flaw is critical for maintaining system integrity and protecting user privacy.