JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged… (CVE-2026-108615)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the AiragExtDataController delete handler. This vulnerability permits low-privileged authenticated users to delete AI evaluator records of other users without proper owner or tenant checks. Exploitation involves sending DELETE requests to the /airag/extData/delete endpoint with any id parameter, bypassing authorization controls. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

An attacker with low privileges can delete AI evaluator or test-tracking records belonging to other users, potentially disrupting data integrity and availability. There is no confidentiality impact reported. This could affect the reliability of AI evaluation data and test tracking within affected JeecgBoot deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /airag/extData/delete endpoint to trusted users only and monitor for unauthorized delete requests. Implement additional authorization checks at the application level if possible.