JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video… (CVE-2026-108607)

The vulnerability in JeecgBoot up to version 3.9.5 is an insecure direct object reference (CWE-639) that permits authenticated users to delete AI video generation records of other users by manipulating the userId parameter in the DELETE /airag/video/deleteVideoRecord API. The GET /airag/video/listByUser endpoint does not properly restrict access to record IDs, enabling attackers to enumerate victim records and delete them individually from Redis storage.

An authenticated attacker can delete AI video generation records of other users, causing loss of video history data stored in Redis. There is no confidentiality or availability impact beyond the deletion of these records. The vulnerability does not allow unauthorized access or privilege escalation beyond the authenticated user's permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious deletion activity. Implement proper authorization checks on userId parameters to ensure users can only delete their own records.