JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any… (CVE-2026-108611)

CVE-2026-108611 describes a missing authorization vulnerability in JeecgBoot up to version 3.9.5 within the AigcWordTemplateController's delete handler. Authenticated users with low privileges can exploit this by sending DELETE requests to the /airag/word/delete endpoint with a specified id, enabling them to permanently remove any word template from the shared library. This indicates a lack of proper access control checks on the delete operation.

The vulnerability allows unauthorized deletion of word templates by any authenticated user, leading to integrity loss of shared resources. There is no confidentiality impact, but the integrity and availability of templates are affected, potentially disrupting normal operations relying on these templates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious delete requests. Implement additional access control measures if possible.