JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI… (CVE-2026-108877)

The vulnerability in JeecgBoot up to version 3.9.5 is a missing authorization check in the AiragPromptsController. Authenticated users can exploit this by calling the DELETE /airag/prompts/delete endpoint to remove AI prompt templates. Since the GET /airag/prompts/list endpoint does not restrict access, attackers can obtain template IDs and delete prompt templates of other users without proper authorization, leading to denial of availability of those templates.

The vulnerability allows low-privileged authenticated users to delete AI prompt templates belonging to other users, causing loss of availability of these templates. There is no confidentiality impact, but the integrity and availability of prompt templates are affected. The CVSS v3.1 base score is 5.4 (medium severity) reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor usage for suspicious deletion activity. Implement additional authorization checks on the DELETE /airag/prompts/delete endpoint to ensure only authorized users can delete prompt templates.