JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user… (CVE-2026-108613)

CVE-2026-108613 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the AiragAppController release handler. Authenticated users can exploit this flaw by sending POST requests to the /airag/app/release endpoint, enabling them to publish or unpublish AI applications owned by other users. This unauthorized action can lead to exposure of applications via share tokens to anonymous users or invalidate existing share links. The vulnerability does not impact confidentiality but affects integrity and availability, as indicated by the CVSS vector (C:N/I:L/A:L).

The vulnerability allows low-privileged authenticated users to manipulate the publication status of other users' AI applications. This can result in unauthorized exposure of applications to anonymous users through share tokens or disruption by invalidating share links. While confidentiality is not affected, the integrity and availability of the affected applications are compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the /airag/app/release endpoint to trusted users only and monitor for suspicious activity related to application publishing actions.