JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any… (CVE-2026-108666)

CVE-2026-108666 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the deleteBatch handler of the AiragPromptsController. Authenticated users with low privileges can exploit this flaw by retrieving prompt IDs from an unprotected list endpoint and invoking deleteBatch to remove AI prompt templates created by administrators or other users. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts.

The vulnerability allows unauthorized deletion of AI prompt templates by any authenticated user, including those with low privileges. This can lead to loss of important data (integrity impact) and disruption of service (availability impact). There is no confidentiality impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious deletion activity. Implement additional authorization checks on the deleteBatch handler to ensure only authorized users can delete prompt templates.