JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user… (CVE-2026-108606)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the AiOcrController's deleteById handler. This vulnerability permits any authenticated user to delete OCR records without proper authorization checks. Low-privileged attackers can leverage the unprotected GET /airag/ocr/list endpoint to obtain record IDs and repeatedly delete shared OCR prompt records stored in Redis. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

The vulnerability allows unauthorized deletion of OCR records by any authenticated user, including low-privileged attackers. This can lead to denial of service on OCR data availability by repeatedly deleting shared OCR prompt records stored in Redis. There is no confidentiality impact, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for unusual deletion activity. Implement additional authorization checks on the deleteById handler to ensure only authorized users can delete OCR records.