JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user… (CVE-2026-108665)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the AiragPromptsController's edit handler. This allows authenticated users with low privileges to send PUT or POST requests to the /airag/prompts/edit endpoint with a template ID, enabling them to modify AI prompt templates, including those created by administrators or other users. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported.

The vulnerability allows low-privileged authenticated users to modify AI prompt templates, potentially altering the behavior of AI-driven features or workflows that depend on these templates. There is no reported impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a patch is available, restrict access to the affected endpoint and monitor for unauthorized modification attempts. Review and enforce proper authorization controls on the AiragPromptsController edit handler.