JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any… (CVE-2026-108670)

CVE-2026-108670 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5 within the promptExperiment handler of AiragPromptsController. Authenticated users with low privileges can exploit this flaw by supplying prompt template and dataset IDs belonging to other users, enabling them to trigger large language model evaluation runs, write results into the airag_ext_data database table, and alter dataset statuses without proper authorization controls.

The vulnerability allows unauthorized authenticated users to manipulate AI prompt experiments by using other users' prompt template and dataset identifiers. This can lead to unauthorized data modification in the airag_ext_data table and changes in dataset status, potentially impacting data integrity and trustworthiness of AI experiment results. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and review application authorization controls to limit exposure.