JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any… (CVE-2026-108668)

The vulnerability in JeecgBoot through version 3.9.5 is due to missing authorization checks in the AiragPromptsController's deleteRecycleBin handler. Authenticated users with low privileges can exploit this by sending crafted DELETE requests with prompt template IDs to purge recycle-bin templates belonging to other users, including administrators. This results in unauthorized deletion of AI prompt templates. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts.

An attacker with any authenticated access can permanently delete AI prompt templates from the recycle bin, including those owned by administrators or other users. This compromises the integrity and availability of these templates but does not expose confidential information.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious DELETE requests targeting prompt templates.