JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows… (CVE-2026-108672)

CVE-2026-108672 describes an authorization bypass vulnerability in JeecgBoot up to version 3.9.5. The issue exists in the getVideoRecords handler of the VideoGenerationController, where the userId parameter is not properly validated for access control. This allows authenticated users with limited privileges to retrieve video generation records belonging to other users, exposing sensitive information such as AI prompts, task identifiers, and video resource URLs. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). No patch or official remediation information is provided in the available data.

An attacker with valid authentication but low privileges can bypass authorization controls to read other users' AI video generation histories. This exposure includes potentially sensitive data such as prompts used for AI video generation, task IDs, and URLs to videos and cover images. There is no indication of impact on integrity or availability, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious access patterns involving the userId parameter. Avoid exposing sensitive user data via this endpoint where possible.