JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated… (CVE-2026-108673)

CVE-2026-108673 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the AiragPromptsController's exportXls handler. Authenticated users with low privileges can exploit this flaw by sending requests to /airag/prompts/exportXls, which results in the export of all users' AI prompts, including sensitive details such as prompt content, model identifiers, and parameters. This vulnerability is categorized under CWE-862 (Missing Authorization). No patch or official remediation information is provided in the available data.

The vulnerability allows unauthorized access to sensitive AI prompt data by any authenticated user, potentially exposing confidential prompt content and configuration parameters. This could lead to information disclosure but does not affect system integrity or availability. The impact is limited to confidentiality with no known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the exportXls handler to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary privileges to users who do not require export capabilities.